theory ArchVSpaceEntries_AI

lemma ensure_safe_mapping_ensures[wp]:
  "\<lbrace>valid_pdpt_objs and (case entries of (Inl (SmallPagePTE _ _ _, [_])) \<Rightarrow> \<top>
                  | (Inl (SmallPagePTE _ _ _, _)) \<Rightarrow> \<bottom>
                  | (Inl (LargePagePTE _ _ _, [])) \<Rightarrow> \<bottom>
                  | (Inr (SectionPDE _ _ _ _, [_])) \<Rightarrow> \<top>
                  | (Inr (SuperSectionPDE _ _ _, [])) \<Rightarrow> \<bottom>
                  | (Inr (SectionPDE _ _ _ _, _)) \<Rightarrow> \<bottom>
                  | _ \<Rightarrow> page_inv_entries_pre entries)\<rbrace>
     ensure_safe_mapping entries
   \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>,-" proof - have [simp]:
      "\<And>s a. page_inv_entries_pre (Inl (pte.InvalidPTE, a)) s \<Longrightarrow>
      page_inv_entries_safe (Inl (pte.InvalidPTE, a)) s" apply (clarsimp simp:page_inv_entries_pre_def page_inv_entries_safe_def
        split:if_splits) done have name_pre:
      "\<And>F P Q. (\<And>s. P s \<Longrightarrow> \<lbrace>(=) s \<rbrace> F \<lbrace>Q\<rbrace>, -) \<Longrightarrow> \<lbrace>P\<rbrace> F \<lbrace>Q\<rbrace>,-" apply (simp add:validE_R_def validE_def) apply (rule hoare_name_pre_state) apply assumption done have mask_neg_mask_order[simp]:
      "\<And>a m n. a && ~~ mask m && mask n = a && mask n && ~~ mask m" by (simp add:word_bw_comms word_bw_lcs) have align_entry_ptD:
      "\<And>pt m x xb xc. \<lbrakk>pt m = pte.LargePagePTE x xb xc; entries_align pte_range_sz pt\<rbrakk>
       \<Longrightarrow> is_aligned m 4" apply (simp add:entries_align_def) apply (drule_tac x = m in spec,simp) done have align_entry_pdD:
      "\<And>pd m x xb xc. \<lbrakk>pd m = pde.SuperSectionPDE x xb xc; entries_align pde_range_sz pd\<rbrakk>
       \<Longrightarrow> is_aligned m 4" apply (simp add:entries_align_def) apply (drule_tac x = m in spec,simp) done have pt_offset_bitwise[simp]:"\<And>a. (ucast ((a::word32) && mask pt_bits && ~~ mask 6  >> 2)::word8)
      = (ucast (a  && mask pt_bits >> 2)::word8) && ~~ mask 4" apply (simp add:pt_bits_def pageBits_def mask_def) apply word_bitwise done have pd_offset_bitwise[simp]:"\<And>a. (ucast ((a::word32) && mask pd_bits && ~~ mask 6  >> 2)::12 word)
      = (ucast (a  && mask pd_bits >> 2)::12 word) && ~~ mask 4" apply (simp add:pt_bits_def pageBits_def mask_def pd_bits_def) apply word_bitwise done have mask_neq_0:
      "\<And>z zs xa p g. \<lbrakk>[0 :: word32, 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk>
         \<Longrightarrow> (p + xa && mask g >> 2) && mask 4 \<noteq> 0" apply (rule ccontr) apply (simp add:is_aligned_mask[symmetric]) apply (drule is_aligned_shiftl[where n = 6 and m = 2,simplified]) apply (subst (asm) shiftr_shiftl1) apply simp+ apply (subst (asm) is_aligned_neg_mask_eq) apply (rule is_aligned_andI1) apply (erule aligned_add_aligned) apply (clarsimp simp :upto_enum_def upto_enum_step_def
         Fun.comp_def upto_0_to_n2 is_aligned_mult_triv2[where n = 2,simplified]) apply simp apply (simp add:is_aligned_mask mask_twice
        pt_bits_def pageBits_def min_def) apply (subst (asm) is_aligned_mask[symmetric]) apply (subst (asm) is_aligned_add_helper) apply simp apply (clarsimp simp :upto_enum_def upto_enum_step_def
         Fun.comp_def upto_0_to_n2) apply (subst shiftl_t2n
        [where n = 2,simplified field_simps,simplified,symmetric])+ apply (rule shiftl_less_t2n[where m = 6,simplified]) apply (rule word_of_nat_less) apply simp apply simp apply (clarsimp simp :upto_enum_def upto_enum_step_def
         Fun.comp_def upto_0_to_n2) apply (cut_tac x = "of_nat x" and n = 2 in word_power_nonzero_32) apply (simp add:word_of_nat_less word_bits_def of_nat_neq_0)+ done have neq_pt_offset: "\<And>z zs xa (p::word32). \<lbrakk>[0 , 4 .e. 0x3C] = z # zs;
        xa \<in> set zs;is_aligned p 6 \<rbrakk> \<Longrightarrow>
        ucast (p + xa && mask pt_bits >> 2) && ~~ mask 4 \<noteq> ((ucast (p + xa && mask pt_bits >> 2))::word8)" apply (rule ccontr) apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric]) apply (drule arg_cong[where f = unat]) apply (simp add:unat_ucast) apply (subst (asm) mod_less) apply (rule unat_less_helper) apply (rule le_less_trans[OF word_and_le1]) apply (simp add:mask_def) apply (simp add:unat_eq_0) apply (drule(2) mask_neq_0[of _ _ _ _ pt_bits]) apply (simp add:pt_bits_def pageBits_def)+ done have neq_pd_offset: "\<And>z zs xa (p::word32). \<lbrakk>[0 , 4 .e. 0x3C] = z # zs;
        xa \<in> set zs;is_aligned p 6 \<rbrakk> \<Longrightarrow>
        ucast (p + xa && mask pd_bits >> 2) && ~~ mask 4 \<noteq> ((ucast (p + xa && mask pd_bits >> 2)) :: 12 word)" apply (simp add:mask_out_sub_mask) apply (rule ccontr) apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric]) apply (drule arg_cong[where f = unat]) apply (simp add:unat_ucast) apply (subst (asm) mod_less) apply (rule unat_less_helper) apply (rule le_less_trans[OF word_and_le1]) apply (simp add:mask_def) apply (simp add:unat_eq_0) apply (drule(2) mask_neq_0[of _ _ _ _ pd_bits]) apply (simp add:pd_bits_def pageBits_def)+ done have invalid_pteI:
      "\<And>a pt x y z. \<lbrakk>valid_pt_entries pt; (a && ~~ mask 4) \<noteq> a;
       pt (a && ~~ mask 4) = pte.LargePagePTE x y z \<rbrakk>
       \<Longrightarrow> pt a = pte.InvalidPTE" apply (drule(1) valid_entriesD[rotated]) apply (case_tac "pt a"; simp add:mask_lower_twice is_aligned_neg_mask split:if_splits) done have invalid_pdeI:
      "\<And>a pd x y z. \<lbrakk>valid_pd_entries pd; (a && ~~ mask 4) \<noteq> a;
       pd (a && ~~ mask 4) = pde.SuperSectionPDE x y z \<rbrakk>
       \<Longrightarrow> pd a = pde.InvalidPDE" apply (drule(1) valid_entriesD[rotated]) apply (case_tac "pd a",
        simp_all add:mask_lower_twice is_aligned_neg_mask
        split:if_splits) done have inj[simp]:
      "\<And>p. is_aligned (p::word32) 6 \<Longrightarrow> inj_on (\<lambda>x. toEnum x * 4 + p) {Suc 0..<16}" apply (clarsimp simp:inj_on_def) apply (subst (asm) shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])+ apply (drule arg_cong[where f = "\<lambda>x. x >> 2"]) apply (simp add:shiftl_shiftr_id word_of_nat_less) apply (simp add:of_nat_inj) done show ?thesis apply (rule name_pre) apply (case_tac entries) apply (case_tac a, case_tac aa) apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def
       | wp | intro conjI impI)+ apply (simp split:list.splits add:page_inv_entries_pre_def)+ apply (rename_tac obj_ref vm_attributes cap_rights slot slots) apply (elim conjE exE) apply (subst mapME_x_Cons) apply simp apply wp apply (rule_tac Q' = "\<lambda>r s. \<forall>x \<in> set slots. obj_at
                (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and>
                 pt (ucast (x && mask pt_bits >> 2)) = pte.InvalidPTE)
                (hd (slot # slots) && ~~ mask pt_bits) s" in hoare_post_imp_R) apply (wp mapME_x_accumulate_checks[where Q = "\<lambda>s. valid_pdpt_objs s"] ) apply (wp get_master_pte_wp| wpc | simp)+ apply clarsimp apply (frule_tac x = xa in mask_out_same_pt) apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2) apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric]) apply (rule shiftl_less_t2n[where m = 6,simplified]) apply (simp add:word_of_nat_less) apply simp apply (frule_tac x = z in mask_out_same_pt) apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2) apply (clarsimp simp:field_simps obj_at_def
           split:pte.splits) apply (intro conjI impI) apply (clarsimp) apply (drule(1) valid_pdpt_objs_ptD) apply (frule align_entry_ptD,simp) apply simp apply clarsimp apply (drule(1) valid_pdpt_objs_ptD,clarify) apply (erule(4) invalid_pteI[OF _ neq_pt_offset]) apply clarsimp apply (drule(1) valid_pdpt_objs_ptD,clarify) apply (frule align_entry_ptD,simp) apply simp apply (wp hoare_drop_imps |wpc|simp)+ apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2 Fun.comp_def distinct_map) apply (intro exI conjI,fastforce+) apply (simp add:obj_at_def hd_map_simp upto_0_to_n2 upto_enum_def upto_enum_step_def) apply (frule_tac x = 1 in bspec,fastforce+) apply ((wp hoare_drop_imps |wpc|simp)+)[1] apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def
          | wp | intro conjI impI)+ apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton) apply (wp get_master_pte_wp |wpc | simp)+ apply (clarsimp simp:obj_at_def split:pte.splits) apply (clarsimp simp:page_inv_entries_safe_def split:list.splits) apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton) apply (case_tac b,case_tac a) apply ((simp add:page_inv_entries_pre_def page_inv_entries_safe_def
             | wp | intro conjI impI)+)[1] apply simp apply wp[1] apply (simp split: list.splits add:page_inv_entries_pre_def mapME_singleton) apply (wp get_master_pde_wp | wpc | simp)+ apply (clarsimp simp: obj_at_def page_inv_entries_safe_def
                   split: pde.splits) apply (simp split: list.splits if_splits
              add: page_inv_entries_pre_def Let_def page_inv_entries_safe_def) apply (elim conjE exE) apply (subst mapME_x_Cons) apply simp apply wp apply (rule_tac Q' = "\<lambda>r s. \<forall>x \<in> set x22.
                                 obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and>
                                                   pd (ucast (x && mask pd_bits >> 2)) = InvalidPDE)
                               (x21 && ~~ mask pd_bits) s" in hoare_post_imp_R) apply (wp mapME_x_accumulate_checks[where Q = "\<lambda>s. valid_pdpt_objs s"] ) apply (wp get_master_pde_wp| wpc | simp)+ apply clarsimp apply (frule_tac x = xa in mask_out_same_pd) apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2) apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric]) apply (rule shiftl_less_t2n[where m = 6,simplified]) apply (simp add:word_of_nat_less) apply simp apply (frule_tac x = z in mask_out_same_pd) apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2) apply (clarsimp simp: field_simps obj_at_def split: pde.splits) apply (drule(1) valid_pdpt_objs_pdD) apply (intro conjI impI) apply clarsimp apply (frule(1) align_entry_pdD) apply simp apply clarsimp apply (frule(1) align_entry_pdD) apply simp apply clarsimp apply (frule(1) align_entry_pdD) apply simp apply clarsimp apply (erule(4) invalid_pdeI[OF _ neq_pd_offset]) apply (wp hoare_drop_imps |wpc|simp)+ apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2 Fun.comp_def distinct_map) apply (intro exI conjI,fastforce+) apply (simp add:obj_at_def hd_map_simp upto_0_to_n2 upto_enum_def upto_enum_step_def) apply (frule_tac x = 1 in bspec,fastforce+) apply (wp get_master_pde_wp | simp | wpc)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (state)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s a. page_inv_entries_pre (Inl (InvalidPTE, a)) s \<Longrightarrow> page_inv_entries_safe (Inl (InvalidPTE, a)) s proof (prove)
goal:
No subgoals! proof (state)
this:
page_inv_entries_pre (Inl (InvalidPTE, ?a)) ?s \<Longrightarrow> page_inv_entries_safe (Inl (InvalidPTE, ?a)) ?s

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>F P Q. (\<And>s. P s \<Longrightarrow> \<lbrace>(=) s\<rbrace> F \<lbrace>Q\<rbrace>, -) \<Longrightarrow> \<lbrace>P\<rbrace> F \<lbrace>Q\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>F P Q. (\<And>s. P s \<Longrightarrow> \<lbrace>(=) s\<rbrace> F \<lbrace>\<lambda>v s. \<forall>r. v = Inr r \<longrightarrow> Q r s\<rbrace>) \<Longrightarrow> \<lbrace>P\<rbrace> F \<lbrace>\<lambda>v s. \<forall>r. v = Inr r \<longrightarrow> Q r s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>F P Q s. \<lbrakk>\<And>s. P s \<Longrightarrow> \<lbrace>(=) s\<rbrace> F \<lbrace>\<lambda>v s. \<forall>r. v = Inr r \<longrightarrow> Q r s\<rbrace>; P s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> F \<lbrace>\<lambda>v s. \<forall>r. v = Inr r \<longrightarrow> Q r s\<rbrace> proof (prove)
goal:
No subgoals! proof (state)
this:
(\<And>s. ?P1 s \<Longrightarrow> \<lbrace>(=) s\<rbrace> ?F1 \<lbrace>?Q1\<rbrace>, -) \<Longrightarrow> \<lbrace>?P1\<rbrace> ?F1 \<lbrace>?Q1\<rbrace>, -

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>a m n. a && ~~ mask m && mask n = a && mask n && ~~ mask m proof (state)
this:
?a2 && ~~ mask ?m2 && mask ?n2 = ?a2 && mask ?n2 && ~~ mask ?m2

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>pt m x xb xc. \<lbrakk>pt m = LargePagePTE x xb xc; entries_align pte_range_sz pt\<rbrakk> \<Longrightarrow> is_aligned m 4 proof (prove)
goal (1 subgoal):
 1. \<And>pt m x xb xc. \<lbrakk>pt m = LargePagePTE x xb xc; \<forall>x. is_aligned x (pte_range_sz (pt x))\<rbrakk> \<Longrightarrow> is_aligned m 4 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?pt3 ?m3 = LargePagePTE ?x3 ?xb3 ?xc3; entries_align pte_range_sz ?pt3\<rbrakk> \<Longrightarrow> is_aligned ?m3 4

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>pd m x xb xc. \<lbrakk>pd m = SuperSectionPDE x xb xc; entries_align pde_range_sz pd\<rbrakk> \<Longrightarrow> is_aligned m 4 proof (prove)
goal (1 subgoal):
 1. \<And>pd m x xb xc. \<lbrakk>pd m = SuperSectionPDE x xb xc; \<forall>x. is_aligned x (pde_range_sz (pd x))\<rbrakk> \<Longrightarrow> is_aligned m 4 proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?pd4 ?m4 = SuperSectionPDE ?x4 ?xb4 ?xc4; entries_align pde_range_sz ?pd4\<rbrakk> \<Longrightarrow> is_aligned ?m4 4

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>a. UCAST(32 \<rightarrow> 8) (a && mask pt_bits && ~~ mask 6 >> 2) = UCAST(32 \<rightarrow> 8) (a && mask pt_bits >> 2) && ~~ mask 4 proof (prove)
goal (1 subgoal):
 1. \<And>a. UCAST(32 \<rightarrow> 8) (a && 0x3C0 >> 2) = UCAST(32 \<rightarrow> 8) (a && 0x3FF >> 2) && 0xF0 proof (prove)
goal:
No subgoals! proof (state)
this:
UCAST(32 \<rightarrow> 8) (?a5 && mask pt_bits && ~~ mask 6 >> 2) = UCAST(32 \<rightarrow> 8) (?a5 && mask pt_bits >> 2) && ~~ mask 4

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>a. UCAST(32 \<rightarrow> 12) (a && mask pd_bits && ~~ mask 6 >> 2) = UCAST(32 \<rightarrow> 12) (a && mask pd_bits >> 2) && ~~ mask 4 proof (prove)
goal (1 subgoal):
 1. \<And>a. UCAST(32 \<rightarrow> 12) (a && 0x3FC0 >> 2) = UCAST(32 \<rightarrow> 12) (a && 0x3FFF >> 2) && 0xFF0 proof (prove)
goal:
No subgoals! proof (state)
this:
UCAST(32 \<rightarrow> 12) (?a5 && mask pd_bits && ~~ mask 6 >> 2) = UCAST(32 \<rightarrow> 12) (?a5 && mask pd_bits >> 2) && ~~ mask 4

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk> \<Longrightarrow> (p + xa && mask g >> 2) && mask 4 \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; \<not> (p + xa && mask g >> 2) && mask 4 \<noteq> 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned (p + xa && mask g >> 2) 4\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned (p + xa && mask g >> 2 << 2) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk> \<Longrightarrow> 2 \<le> 2
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned ((p + xa && mask g >> 2 - 2) && ~~ mask 2) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned ((p + xa && mask g) && ~~ mask 2) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk> \<Longrightarrow> is_aligned (p + xa && mask g) 2
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned (p + xa && mask g) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk> \<Longrightarrow> is_aligned (p + xa) 2
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned (p + xa && mask g) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; 6 \<le> g\<rbrakk> \<Longrightarrow> is_aligned xa 2
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; 6 \<le> g\<rbrakk> \<Longrightarrow> 2 \<le> 6
 3. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned (p + xa && mask g) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; 6 \<le> g\<rbrakk> \<Longrightarrow> 2 \<le> 6
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned (p + xa && mask g) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; is_aligned (p + xa && mask g) 6\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; p && mask 6 = 0; 6 \<le> g; p + xa && mask 6 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; p + xa && mask 6 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk> \<Longrightarrow> is_aligned p 6
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk> \<Longrightarrow> xa < 2 ^ 6
 3. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g\<rbrakk> \<Longrightarrow> xa < 2 ^ 6
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x * 4 < 0x40
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x << 2 < 0x40
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (6 - 2)
 2. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 6 < LENGTH(32)
 3. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> x < unat (2 ^ (6 - 2))
 2. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 6 < LENGTH(32)
 3. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 6 < LENGTH(32)
 2. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p g. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; 6 \<le> g; xa = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; word_of_nat x * 4 = 0; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; word_of_nat x * 4 = 0; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (word_bits - 2)
 2. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; word_of_nat x * 4 = 0; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 2 < word_bits
 3. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; word_of_nat x * 4 = 0; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x \<noteq> 0
 4. \<And>p g x. \<lbrakk>is_aligned p 6; 6 \<le> g; word_of_nat x * 4 = 0; Suc 0 \<le> x; x < 16; word_of_nat x * 2\<^sup>2 \<noteq> 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>[0 , 4 .e. 0x3C] = ?z5 # ?zs5; ?xa5 \<in> set ?zs5; is_aligned ?p5 6; 6 \<le> ?g5\<rbrakk> \<Longrightarrow> (?p5 + ?xa5 && mask ?g5 >> 2) && mask 4 \<noteq> 0

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4 \<noteq> UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; \<not> UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4 \<noteq> UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; UCAST(32 \<rightarrow> 8) ((p + xa && mask pt_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat (UCAST(32 \<rightarrow> 8) ((p + xa && mask pt_bits >> 2) && mask 4)) = unat 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pt_bits >> 2) && mask 4) mod 256 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> unat ((p + xa && mask pt_bits >> 2) && mask 4) < 256
 2. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pt_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> (p + xa && mask pt_bits >> 2) && mask 4 < word_of_nat 256
 2. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pt_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> mask 4 < word_of_nat 256
 2. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pt_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pt_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; (p + xa && mask pt_bits >> 2) && mask 4 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>xa \<in> set zs; is_aligned p 6; (p + xa && mask pt_bits >> 2) && mask 4 = 0\<rbrakk> \<Longrightarrow> 6 \<le> pt_bits
 2. \<And>z zs xa p. \<lbrakk>xa \<in> set zs; is_aligned p 6; (p + xa && mask pt_bits >> 2) && mask 4 = 0; (p + xa && mask pt_bits >> 2) && mask 4 \<noteq> 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>[0 , 4 .e. 0x3C] = ?z5 # ?zs5; ?xa5 \<in> set ?zs5; is_aligned ?p5 6\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 8) (?p5 + ?xa5 && mask pt_bits >> 2) && ~~ mask 4 \<noteq> UCAST(32 \<rightarrow> 8) (?p5 + ?xa5 && mask pt_bits >> 2)

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4 \<noteq> UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && mask 4 \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; \<not> UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && mask 4 \<noteq> 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; UCAST(32 \<rightarrow> 12) ((p + xa && mask pd_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat (UCAST(32 \<rightarrow> 12) ((p + xa && mask pd_bits >> 2) && mask 4)) = unat 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pd_bits >> 2) && mask 4) mod 4096 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> unat ((p + xa && mask pd_bits >> 2) && mask 4) < 4096
 2. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pd_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> (p + xa && mask pd_bits >> 2) && mask 4 < word_of_nat 4096
 2. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pd_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6\<rbrakk> \<Longrightarrow> mask 4 < word_of_nat 4096
 2. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pd_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; unat ((p + xa && mask pd_bits >> 2) && mask 4) = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>z zs xa p. \<lbrakk>[0 , 4 .e. 0x3C] = z # zs; xa \<in> set zs; is_aligned p 6; (p + xa && mask pd_bits >> 2) && mask 4 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>z zs xa p. \<lbrakk>xa \<in> set zs; is_aligned p 6; (p + xa && mask pd_bits >> 2) && mask 4 = 0\<rbrakk> \<Longrightarrow> 6 \<le> pd_bits
 2. \<And>z zs xa p. \<lbrakk>xa \<in> set zs; is_aligned p 6; (p + xa && mask pd_bits >> 2) && mask 4 = 0; (p + xa && mask pd_bits >> 2) && mask 4 \<noteq> 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>[0 , 4 .e. 0x3C] = ?z5 # ?zs5; ?xa5 \<in> set ?zs5; is_aligned ?p5 6\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (?p5 + ?xa5 && mask pd_bits >> 2) && ~~ mask 4 \<noteq> UCAST(32 \<rightarrow> 12) (?p5 + ?xa5 && mask pd_bits >> 2)

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>a pt x y z. \<lbrakk>valid_entries pte_range pt; a && ~~ mask 4 \<noteq> a; pt (a && ~~ mask 4) = LargePagePTE x y z\<rbrakk> \<Longrightarrow> pt a = InvalidPTE proof (prove)
goal (1 subgoal):
 1. \<And>a pt x y z. \<lbrakk>a && ~~ mask 4 \<noteq> a; pt (a && ~~ mask 4) = LargePagePTE x y z; pte_range (pt (a && ~~ mask 4)) (a && ~~ mask 4) \<inter> pte_range (pt a) a = {}\<rbrakk> \<Longrightarrow> pt a = InvalidPTE proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>valid_entries pte_range ?pt5; ?a5 && ~~ mask 4 \<noteq> ?a5; ?pt5 (?a5 && ~~ mask 4) = LargePagePTE ?x5 ?y5 ?z5\<rbrakk> \<Longrightarrow> ?pt5 ?a5 = InvalidPTE

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>a pd x y z. \<lbrakk>valid_entries pde_range pd; a && ~~ mask 4 \<noteq> a; pd (a && ~~ mask 4) = SuperSectionPDE x y z\<rbrakk> \<Longrightarrow> pd a = InvalidPDE proof (prove)
goal (1 subgoal):
 1. \<And>a pd x y z. \<lbrakk>a && ~~ mask 4 \<noteq> a; pd (a && ~~ mask 4) = SuperSectionPDE x y z; pde_range (pd (a && ~~ mask 4)) (a && ~~ mask 4) \<inter> pde_range (pd a) a = {}\<rbrakk> \<Longrightarrow> pd a = InvalidPDE proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>valid_entries pde_range ?pd5; ?a5 && ~~ mask 4 \<noteq> ?a5; ?pd5 (?a5 && ~~ mask 4) = SuperSectionPDE ?x5 ?y5 ?z5\<rbrakk> \<Longrightarrow> ?pd5 ?a5 = InvalidPDE

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>p. is_aligned p 6 \<Longrightarrow> inj_on (\<lambda>x. toEnum x * 4 + p) {Suc 0..<16} proof (prove)
goal (1 subgoal):
 1. \<And>p x y. \<lbrakk>is_aligned p 6; word_of_nat x * 4 = word_of_nat y * 4; Suc 0 \<le> x; x < 16; Suc 0 \<le> y; y < 16\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (1 subgoal):
 1. \<And>p x y. \<lbrakk>is_aligned p 6; word_of_nat x << 2 = word_of_nat y << 2; Suc 0 \<le> x; x < 16; Suc 0 \<le> y; y < 16\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (1 subgoal):
 1. \<And>p x y. \<lbrakk>is_aligned p 6; Suc 0 \<le> x; x < 16; Suc 0 \<le> y; y < 16; word_of_nat x << 2 >> 2 = word_of_nat y << 2 >> 2\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (1 subgoal):
 1. \<And>p x y. \<lbrakk>is_aligned p 6; Suc 0 \<le> x; x < 16; Suc 0 \<le> y; y < 16; word_of_nat x = word_of_nat y\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal:
No subgoals! proof (state)
this:
is_aligned ?p5 6 \<Longrightarrow> inj_on (\<lambda>x. toEnum x * 4 + ?p5) {Suc 0..<16}

goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s. ((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s a. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 2. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s a aa b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = InvalidPTE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 2. \<And>s a aa b x21 x22 x23. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 3. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 4. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s a aa b x21 x22 x23 sa. \<lbrakk>(\<forall>x\<in>ran (kheap sa). obj_valid_pdpt x) \<and> (case b of [] \<Rightarrow> \<lambda>_. False | a # list \<Rightarrow> page_inv_entries_pre entries) sa; entries = Inl (LargePagePTE x21 x22 x23, b); a = (LargePagePTE x21 x22 x23, b); aa = LargePagePTE x21 x22 x23; \<exists>sl. b = [sl]; s = sa\<rbrakk> \<Longrightarrow> False
 2. \<And>s a aa b x21 x22 x23. \<lbrakk>(\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case b of [] \<Rightarrow> \<lambda>_. False | a # list \<Rightarrow> page_inv_entries_pre entries) s; entries = Inl (LargePagePTE x21 x22 x23, b); a = (LargePagePTE x21 x22 x23, b); aa = LargePagePTE x21 x22 x23; \<forall>sl. b \<noteq> [sl]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) b \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set (tl b). pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (hd b && ~~ mask pt_bits) s\<rbrace>, -
 3. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 4. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b x21 x22 x23 x21a x22a. \<lbrakk>entries = Inl (LargePagePTE x21 x22 x23, x21a # x22a); a = (LargePagePTE x21 x22 x23, x21a # x22a); aa = LargePagePTE x21 x22 x23; x22a \<noteq> []; b = x21a # x22a; (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (\<exists>p. is_aligned p 6 \<and> x21a # x22a = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) (x21a # x22a) \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> x21a # x22a = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set x22a. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (x21a && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, slot # slots); a = (LargePagePTE obj_ref vm_attributes cap_rights, slot # slots); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = slot # slots; (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (\<exists>p. is_aligned p 6 \<and> slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) (slot # slots) \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, slot # slots); a = (LargePagePTE obj_ref vm_attributes cap_rights, slot # slots); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = slot # slots; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) (slot # slots) \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, slot # slots); a = (LargePagePTE obj_ref vm_attributes cap_rights, slot # slots); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = slot # slots; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst);
mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) slots
odE \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE y <- liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst);
mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) slots
odE \<lbrace>\<lambda>rv s. \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?B57 s a aa b obj_ref vm_attributes cap_rights slot slots p y\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) slots \<lbrace>\<lambda>rv s. \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>?B57 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 4. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 5. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?B57 s a aa b obj_ref vm_attributes cap_rights slot slots p y\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst)) slots \<lbrace>\<lambda>r s. \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>?B57 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 5. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 6. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>?P'74 s a aa b obj_ref vm_attributes cap_rights slot slots p y x xa\<rbrace> case xa of SmallPagePTE word set1 set2 \<Rightarrow> throwError DeleteFirst | _ \<Rightarrow> returnOk () \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, -
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) \<lbrace>\<lambda>xa sa. True \<and> ?P'74 s a aa b obj_ref vm_attributes cap_rights slot slots p y x xa sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p x sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x\<rbrakk> \<Longrightarrow> \<forall>pt. ako_at (PageTable pt) (x && ~~ mask pt_bits) sa \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE xa xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (x && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) && ~~ mask pt_bits) sa) \<and> ((\<exists>xa xb xc. (case pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE xa xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (x && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2))) = LargePagePTE xa xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) && ~~ mask pt_bits) sa)
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs\<rbrakk> \<Longrightarrow> xa < 2 ^ 6
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa pt x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageTable pt) (word_of_nat x * 4 + p && ~~ mask pt_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x * 4 < 0x40
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa pt x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageTable pt) (word_of_nat x * 4 + p && ~~ mask pt_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x << 2 < 0x40
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (11 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa pt x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageTable pt) (word_of_nat x * 4 + p && ~~ mask pt_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (6 - 2)
 2. \<And>s obj_ref vm_attributes cap_rights p sa pt x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageTable pt) (word_of_nat x * 4 + p && ~~ mask pt_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 6 < LENGTH(32)
 3. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 10. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa pt x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageTable pt) (word_of_nat x * 4 + p && ~~ mask pt_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 6 < LENGTH(32)
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> z < 2 ^ 6
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageTable pt) (xa + p && ~~ mask pt_bits) sa; xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa) \<and> ((\<exists>x xb xc. (case pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2))) = LargePagePTE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (xa + p && mask pt_bits >> 2)) = InvalidPTE) (z + p && ~~ mask pt_bits) sa)
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits\<rbrakk> \<Longrightarrow> (pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = InvalidPTE \<longrightarrow> (\<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc) \<longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE) \<and> ((\<exists>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23) \<longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE) \<and> ((\<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33) \<longrightarrow> (\<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc) \<longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE)
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (11 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = InvalidPTE; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 3. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 10. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x xb xc. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = InvalidPTE; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> False
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 3. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 10. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x xb xc. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = InvalidPTE; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc; valid_entries pte_range pt \<and> entries_align pte_range_sz pt\<rbrakk> \<Longrightarrow> False
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 3. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 10. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x xb xc. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = InvalidPTE; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc; valid_entries pte_range pt \<and> entries_align pte_range_sz pt; is_aligned (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 3. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 10. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x21 x22 x23. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x21 x22 x23. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x21 x22 x23. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = LargePagePTE x21 x22 x23; valid_entries pte_range pt; entries_align pte_range_sz pt\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 2. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 9. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 10. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; \<exists>x31 x32 x33. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; \<exists>x xb xc. pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = InvalidPTE
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x31 x x32 xb x33 xc. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc\<rbrakk> \<Longrightarrow> False
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x31 x x32 xb x33 xc. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc; valid_entries pte_range pt; entries_align pte_range_sz pt\<rbrakk> \<Longrightarrow> False
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s obj_ref vm_attributes cap_rights p sa z zs pt xa x31 x x32 xb x33 xc. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pt_bits) = Some (ArchObj (PageTable pt)); xa \<in> set zs; p + xa && ~~ mask pt_bits = p && ~~ mask pt_bits; p + z && ~~ mask pt_bits = p && ~~ mask pt_bits; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2) && ~~ mask 4) = SmallPagePTE x31 x32 x33; pt (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) = LargePagePTE x xb xc; valid_entries pte_range pt; entries_align pte_range_sz pt; is_aligned (UCAST(32 \<rightarrow> 8) (p + xa && mask pt_bits >> 2)) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 8. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 9. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set slots\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y x ya. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace> liftE (get_master_pte x) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (ya && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 5. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 7. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 8. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct slots
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 5. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 6. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 4. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 5. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p y rv sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set slots. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE) (hd (slot # slots) && ~~ mask pt_bits) sa\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set slots. pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (slot && ~~ mask pt_bits) sa
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 4. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 5. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, slot # map ((\<lambda>x. x + slot) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); a = (LargePagePTE obj_ref vm_attributes cap_rights, slot # map ((\<lambda>x. x + slot) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); aa = LargePagePTE obj_ref vm_attributes cap_rights; b = slot # map ((\<lambda>x. x + slot) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned slot 6; slots = map ((\<lambda>x. x + slot) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]; \<forall>x\<in>{Suc 0..<16}. \<exists>ko. kheap sa (slot && ~~ mask pt_bits) = Some ko \<and> (\<exists>pt. ko = ArchObj (PageTable pt) \<and> pt (UCAST(32 \<rightarrow> 8) (word_of_nat x * 4 + slot && mask pt_bits >> 2)) = InvalidPTE)\<rbrakk> \<Longrightarrow> \<exists>ko. kheap sa (slot && ~~ mask pt_bits) = Some ko \<and> (\<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>{Suc 0..<16}. pt (UCAST(32 \<rightarrow> 8) (word_of_nat x * 4 + slot && mask pt_bits >> 2)) = InvalidPTE))
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 4. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 5. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p\<rbrace> liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>x xa xb. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'56 s a aa b obj_ref vm_attributes cap_rights slot slots p sa
 3. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 4. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b obj_ref vm_attributes cap_rights slot slots p sa. \<lbrakk>entries = Inl (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = (LargePagePTE obj_ref vm_attributes cap_rights, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); aa = LargePagePTE obj_ref vm_attributes cap_rights; slots \<noteq> []; b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; slot # slots = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> True \<and> True \<and> (\<forall>x\<in>ran (kheap sa). obj_valid_pdpt x) \<and> (\<forall>a\<in>ran (kheap sa). obj_valid_pdpt a)
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inl a; a = (aa, b); aa = SmallPagePTE x31 x32 x33\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b x31 x32 x33. \<lbrakk>(\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case b of [] \<Rightarrow> \<lambda>_. False | [xc] \<Rightarrow> \<lambda>_. True | xc # aa # lista \<Rightarrow> \<lambda>_. False) s; entries = Inl (SmallPagePTE x31 x32 x33, b); a = (SmallPagePTE x31 x32 x33, b); aa = SmallPagePTE x31 x32 x33; \<exists>sl. b = [sl]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) b \<lbrace>\<lambda>rv. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pte_range_sz (pt (UCAST(32 \<rightarrow> 8) (hd b && mask pt_bits >> 2) && ~~ mask 4)) = 0) (hd b && ~~ mask pt_bits)\<rbrace>, -
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>(\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case b of [] \<Rightarrow> \<lambda>_. False | [xc] \<Rightarrow> \<lambda>_. True | xc # aa # lista \<Rightarrow> \<lambda>_. False) s; entries = Inl (SmallPagePTE x31 x32 x33, b); a = (SmallPagePTE x31 x32 x33, b); aa = SmallPagePTE x31 x32 x33; \<forall>sl. b \<noteq> [sl]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) b \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set (tl b). pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (hd b && ~~ mask pt_bits) s\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b x31 x32 x33 x21 sl. \<lbrakk>entries = Inl (SmallPagePTE x31 x32 x33, [sl]); a = (SmallPagePTE x31 x32 x33, [sl]); aa = SmallPagePTE x31 x32 x33; x21 = sl; b = [sl]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftE (get_master_pte sl) >>=E case_pte (returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>rv. obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pte_range_sz (pt (UCAST(32 \<rightarrow> 8) (sl && mask pt_bits >> 2) && ~~ mask 4)) = 0) (sl && ~~ mask pt_bits)\<rbrace>, -
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>(\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case b of [] \<Rightarrow> \<lambda>_. False | [xc] \<Rightarrow> \<lambda>_. True | xc # aa # lista \<Rightarrow> \<lambda>_. False) s; entries = Inl (SmallPagePTE x31 x32 x33, b); a = (SmallPagePTE x31 x32 x33, b); aa = SmallPagePTE x31 x32 x33; \<forall>sl. b \<noteq> [sl]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) b \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set (tl b). pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (hd b && ~~ mask pt_bits) s\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s a aa b x31 x32 x33 x21 sl sa. \<lbrakk>entries = Inl (SmallPagePTE x31 x32 x33, [sl]); a = (SmallPagePTE x31 x32 x33, [sl]); aa = SmallPagePTE x31 x32 x33; x21 = sl; b = [sl]; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; s = sa\<rbrakk> \<Longrightarrow> \<forall>pt. ako_at (PageTable pt) (sl && ~~ mask pt_bits) sa \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (sl && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (sl && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (sl && mask pt_bits >> 2))) = InvalidPTE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pte_range_sz (pt (UCAST(32 \<rightarrow> 8) (sl && mask pt_bits >> 2) && ~~ mask 4)) = 0) (sl && ~~ mask pt_bits) sa) \<and> ((\<exists>x xa xb. (case pt (UCAST(32 \<rightarrow> 8) (sl && mask pt_bits >> 2) && ~~ mask 4) of LargePagePTE x xa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (sl && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (sl && mask pt_bits >> 2))) = SmallPagePTE x xa xb) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> pte_range_sz (pt (UCAST(32 \<rightarrow> 8) (sl && mask pt_bits >> 2) && ~~ mask 4)) = 0) (sl && ~~ mask pt_bits) sa)
 2. \<And>s a aa b x31 x32 x33. \<lbrakk>(\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case b of [] \<Rightarrow> \<lambda>_. False | [xc] \<Rightarrow> \<lambda>_. True | xc # aa # lista \<Rightarrow> \<lambda>_. False) s; entries = Inl (SmallPagePTE x31 x32 x33, b); a = (SmallPagePTE x31 x32 x33, b); aa = SmallPagePTE x31 x32 x33; \<forall>sl. b \<noteq> [sl]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) b \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set (tl b). pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (hd b && ~~ mask pt_bits) s\<rbrace>, -
 3. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s a aa b x31 x32 x33. \<lbrakk>(\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (case b of [] \<Rightarrow> \<lambda>_. False | [xc] \<Rightarrow> \<lambda>_. True | xc # aa # lista \<Rightarrow> \<lambda>_. False) s; entries = Inl (SmallPagePTE x31 x32 x33, b); a = (SmallPagePTE x31 x32 x33, b); aa = SmallPagePTE x31 x32 x33; \<forall>sl. b \<noteq> [sl]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pte slot) >>=E case_pte (returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) b \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> b = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pt. ko = ArchObj (PageTable pt) \<and> (\<forall>x\<in>set (tl b). pt (UCAST(32 \<rightarrow> 8) (x && mask pt_bits >> 2)) = InvalidPTE)) (hd b && ~~ mask pt_bits) s\<rbrace>, -
 2. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s b. \<lbrakk>((\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s b. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s b a ba. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = InvalidPDE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, -
 2. \<And>s b a ba x21 x22 x23. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, -
 3. \<And>s b a ba x31 x32 x33 x34. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, -
 4. \<And>s b a ba x41 x42 x43. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s b a ba x21 x22 x23. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, -
 2. \<And>s b a ba x31 x32 x33 x34. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, -
 3. \<And>s b a ba x41 x42 x43. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s b a ba x21 x22 x23. \<lbrakk>(\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> page_inv_entries_pre (Inr (PageTablePDE x21 x22 x23, ba)) s; entries = Inr (PageTablePDE x21 x22 x23, ba); b = (PageTablePDE x21 x22 x23, ba); a = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> fail \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr (PageTablePDE x21 x22 x23, ba))\<rbrace>, -
 2. \<And>s b a ba x31 x32 x33 x34. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, -
 3. \<And>s b a ba x41 x42 x43. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s b a ba x31 x32 x33 x34. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, -
 2. \<And>s b a ba x41 x42 x43. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s b a ba x31 x32 x33 x34 x21 x22. \<lbrakk>entries = Inr (SectionPDE x31 x32 x33 x34, [x21]); b = (SectionPDE x31 x32 x33 x34, [x21]); a = SectionPDE x31 x32 x33 x34; ba = [x21]; x22 = []; Ball (ran (kheap s)) obj_valid_pdpt\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>x xa xb xc. returnOk ()) (\<lambda>word set1 set2. throwError DeleteFirst) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr (SectionPDE x31 x32 x33 x34, [x21]))\<rbrace>, -
 2. \<And>s b a ba x41 x42 x43. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s b a ba x31 x32 x33 x34 x21 x22 sa. \<lbrakk>entries = Inr (SectionPDE x31 x32 x33 x34, [x21]); b = (SectionPDE x31 x32 x33 x34, [x21]); a = SectionPDE x31 x32 x33 x34; ba = [x21]; x22 = []; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; s = sa\<rbrakk> \<Longrightarrow> \<forall>pd. ako_at (PageDirectory pd) (x21 && ~~ mask pd_bits) sa \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x21 && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x21 && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x21 && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> page_inv_entries_safe (Inr (SectionPDE x31 x32 x33 x34, [x21])) sa) \<and> ((\<exists>x xa xb xc. (case pd (UCAST(32 \<rightarrow> 12) (x21 && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x21 && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x21 && mask pd_bits >> 2))) = SectionPDE x xa xb xc) \<longrightarrow> page_inv_entries_safe (Inr (SectionPDE x31 x32 x33 x34, [x21])) sa)
 2. \<And>s b a ba x41 x42 x43. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s b a ba x41 x42 x43. \<lbrakk>Ball (ran (kheap s)) obj_valid_pdpt \<and> (case b of (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | (_, xd) \<Rightarrow> page_inv_entries_pre entries) s; entries = Inr b; b = (a, ba); a = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> ensure_safe_mapping (Inr b) \<lbrace>\<lambda>rv. page_inv_entries_safe (Inr b)\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s b a ba x41 x42 x43 x21 x22. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, x21 # x22); b = (SuperSectionPDE x41 x42 x43, x21 # x22); a = SuperSectionPDE x41 x42 x43; ba = x21 # x22; x22 \<noteq> []; (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> (\<exists>p. is_aligned p 6 \<and> x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pde slot) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) (x21 # x22) \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) s\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, x21 # x22); b = (SuperSectionPDE x41 x42 x43, x21 # x22); a = SuperSectionPDE x41 x42 x43; ba = x21 # x22; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pde slot) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) (x21 # x22) \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) s\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, x21 # x22); b = (SuperSectionPDE x41 x42 x43, x21 # x22); a = SuperSectionPDE x41 x42 x43; ba = x21 # x22; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ());
mapME_x (\<lambda>slot. liftE (get_master_pde slot) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) x22
odE \<lbrace>\<lambda>rv s. \<exists>p. is_aligned p 6 \<and> x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) s\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> doE y <- liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ());
mapME_x (\<lambda>slot. liftE (get_master_pde slot) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) x22
odE \<lbrace>\<lambda>rv s. \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) s\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?B683 s b a ba x41 x42 x43 x21 x22 p y\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pde slot) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) x22 \<lbrace>\<lambda>rv s. \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) s\<rbrace>, -
 2. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>?B683 s b a ba x41 x42 x43 x21 x22 p\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (4 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?B683 s b a ba x41 x42 x43 x21 x22 p y\<rbrace> mapME_x (\<lambda>slot. liftE (get_master_pde slot) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ())) x22 \<lbrace>\<lambda>r s. \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) s\<rbrace>, -
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 3. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>?B683 s b a ba x41 x42 x43 x21 x22 p\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p y x xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'699 s b a ba x41 x42 x43 x21 x22 p y x xa\<rbrace> case xa of InvalidPDE \<Rightarrow> returnOk () | SuperSectionPDE x xa xb \<Rightarrow> returnOk () | _ \<Rightarrow> throwError DeleteFirst \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, -
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) \<lbrace>\<lambda>xa sa. True \<and> ?P'699 s b a ba x41 x42 x43 x21 x22 p y x xa sa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p x sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x\<rbrakk> \<Longrightarrow> \<forall>pd. ako_at (PageDirectory pd) (x && ~~ mask pd_bits) sa \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE xa xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa) \<and> ((\<exists>xa xb xc. (case pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE xa xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2))) = SuperSectionPDE xa xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa)
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs\<rbrakk> \<Longrightarrow> xa < 2 ^ 6
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa pd x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageDirectory pd) (word_of_nat x * 4 + p && ~~ mask pd_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x * 4 < 0x40
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa pd x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageDirectory pd) (word_of_nat x * 4 + p && ~~ mask pd_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x << 2 < 0x40
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (9 subgoals):
 1. \<And>s x41 x42 x43 p sa pd x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageDirectory pd) (word_of_nat x * 4 + p && ~~ mask pd_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> word_of_nat x < 2 ^ (6 - 2)
 2. \<And>s x41 x42 x43 p sa pd x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageDirectory pd) (word_of_nat x * 4 + p && ~~ mask pd_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 6 < LENGTH(32)
 3. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 7. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 8. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa pd x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, p # map ((\<lambda>x. x + p) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; ako_at (PageDirectory pd) (word_of_nat x * 4 + p && ~~ mask pd_bits) sa; Suc 0 \<le> x; x < 16\<rbrakk> \<Longrightarrow> 6 < LENGTH(32)
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> z < 2 ^ 6
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (z + p) # map (\<lambda>x. x + p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; ako_at (PageDirectory pd) (xa + p && ~~ mask pd_bits) sa; xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa) \<and> ((\<exists>x xb xc. (case pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2) && ~~ mask 4) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2))) = SuperSectionPDE x xb xc) \<longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (xa + p && mask pd_bits >> 2)) = InvalidPDE) (z + p && ~~ mask pd_bits) sa)
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> (pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = InvalidPDE \<longrightarrow> (\<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE) \<and> ((\<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23) \<longrightarrow> (\<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE) \<and> ((\<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (\<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE) \<and> ((\<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE)
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd\<rbrakk> \<Longrightarrow> (pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = InvalidPDE \<longrightarrow> (\<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE) \<and> ((\<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23) \<longrightarrow> (\<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE) \<and> ((\<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (\<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE) \<and> ((\<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43) \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE)
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (10 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = InvalidPDE; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 4. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 8. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 9. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (10 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa x xb xc. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = InvalidPDE; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc; valid_entries pde_range pd; entries_align pde_range_sz pd\<rbrakk> \<Longrightarrow> False
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 4. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 8. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 9. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (10 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa x xb xc. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = InvalidPDE; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc; valid_entries pde_range pd; entries_align pde_range_sz pd; is_aligned (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 4. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 8. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 9. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (9 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 7. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 8. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (9 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa x21 x x22 xb x23 xc. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc; valid_entries pde_range pd; entries_align pde_range_sz pd\<rbrakk> \<Longrightarrow> False
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 7. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 8. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (9 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa x21 x x22 xb x23 xc. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = PageTablePDE x21 x22 x23; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc; valid_entries pde_range pd; entries_align pde_range_sz pd; is_aligned (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 7. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 8. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; \<exists>x xb xc. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa x31 x x32 xb x33 xc x34. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; valid_entries pde_range pd; entries_align pde_range_sz pd\<rbrakk> \<Longrightarrow> False
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (8 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa x31 x x32 xb x33 xc x34. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = SuperSectionPDE x xb xc; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SectionPDE x31 x32 x33 x34; valid_entries pde_range pd; entries_align pde_range_sz pd; is_aligned (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 6. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 7. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; valid_entries pde_range pd \<and> entries_align pde_range_sz pd; \<exists>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (7 subgoals):
 1. \<And>s x41 x42 x43 p sa z zs pd xa x41a x42a x43a. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, (p + z) # map ((+) p) zs); \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; [0 , 4 .e. 0x3C] = z # zs; zs \<noteq> []; kheap sa (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); xa \<in> set zs; p + xa && ~~ mask pd_bits = p && ~~ mask pd_bits; p + z && ~~ mask pd_bits = p && ~~ mask pd_bits; pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2) && ~~ mask 4) = SuperSectionPDE x41a x42a x43a; valid_entries pde_range pd; entries_align pde_range_sz pd\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (p + xa && mask pd_bits >> 2)) = InvalidPDE
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 5. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 6. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (6 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p y x. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x \<in> set x22\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y x ya. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; ya \<noteq> x\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace> liftE (get_master_pde x) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (ya && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p y. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 4. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 5. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (4 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> distinct x22
 2. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 3. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (3 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> \<exists>pa. is_aligned pa 6 \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> p = pa) \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 2. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (3 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p y rv sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; \<forall>x\<in>set x22. obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE) (x21 && ~~ mask pd_bits) sa\<rbrakk> \<Longrightarrow> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>set x22. pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (x21 && ~~ mask pd_bits) sa
 2. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (3 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, x21 # map ((\<lambda>x. x + x21) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); b = (SuperSectionPDE x41 x42 x43, x21 # map ((\<lambda>x. x + x21) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]); a = SuperSectionPDE x41 x42 x43; ba = x21 # map ((\<lambda>x. x + x21) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned x21 6; x22 = map ((\<lambda>x. x + x21) \<circ> ((\<lambda>x. x * 4) \<circ> toEnum)) [Suc 0..<16]; \<forall>x\<in>{Suc 0..<16}. \<exists>ko. kheap sa (x21 && ~~ mask pd_bits) = Some ko \<and> (\<exists>pd. ko = ArchObj (PageDirectory pd) \<and> pd (UCAST(32 \<rightarrow> 12) (word_of_nat x * 4 + x21 && mask pd_bits >> 2)) = InvalidPDE)\<rbrakk> \<Longrightarrow> \<exists>ko. kheap sa (x21 && ~~ mask pd_bits) = Some ko \<and> (\<exists>pd. ko = ArchObj (PageDirectory pd) \<and> (\<forall>x\<in>{Suc 0..<16}. pd (UCAST(32 \<rightarrow> 12) (word_of_nat x * 4 + x21 && mask pd_bits >> 2)) = InvalidPDE))
 2. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal (2 subgoals):
 1. \<And>s b a ba x41 x42 x43 x21 x22 p. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>?P'682 s b a ba x41 x42 x43 x21 x22 p\<rbrace> liftE (get_master_pde x21) >>=E case_pde (returnOk ()) (\<lambda>word1 set word2. throwError DeleteFirst) (\<lambda>word1 set1 word2 set2. throwError DeleteFirst) (\<lambda>x xa xb. returnOk ()) \<lbrace>\<lambda>y s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s b a ba x41 x42 x43 x21 x22 p sa. \<lbrakk>entries = Inr (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); b = (SuperSectionPDE x41 x42 x43, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]); a = SuperSectionPDE x41 x42 x43; ba = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; x22 \<noteq> []; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned p 6; x21 # x22 = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]; s = sa\<rbrakk> \<Longrightarrow> ?P'682 s b a ba x41 x42 x43 x21 x22 p sa proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>(\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (case entries of Inl (InvalidPTE, xc) \<Rightarrow> page_inv_entries_pre entries | Inl (LargePagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (LargePagePTE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inl (SmallPagePTE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inl (SmallPagePTE x xa xb, [xca]) \<Rightarrow> \<lambda>_. True | Inl (SmallPagePTE x xa xb, xca # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, []) \<Rightarrow> \<lambda>_. False | Inr (SectionPDE x xa xb xc, [xda]) \<Rightarrow> \<lambda>_. True | Inr (SectionPDE x xa xb xc, xda # aa # lista) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, []) \<Rightarrow> \<lambda>_. False | Inr (SuperSectionPDE x xa xb, a # list) \<Rightarrow> page_inv_entries_pre entries | Inr (_, xd) \<Rightarrow> page_inv_entries_pre entries)\<rbrace> ensure_safe_mapping entries \<lbrace>\<lambda>rv. page_inv_entries_safe entries\<rbrace>, -

goal:
No subgoals!