theory ArchVSpace_AI

lemma perform_page_invs [wp]:
  "\<lbrace>invs and valid_page_inv pg_inv\<rbrace> perform_page_invocation pg_inv \<lbrace>\<lambda>_. invs\<rbrace>" apply (simp add: perform_page_invocation_def) apply (cases pg_inv, simp_all)
     \<comment> \<open>PageMap\<close> apply (rename_tac asid cap cslot_ptr sum) apply clarsimp apply (rule hoare_pre) apply (wpsimp wp: get_master_pte_wp get_master_pde_wp mapM_swp_store_pde_invs_unmap
                        store_pde_invs_unmap' hoare_vcg_const_imp_lift hoare_vcg_all_lift
                        set_cap_arch_obj arch_update_cap_invs_map
                  simp: pte_check_if_mapped_def pde_check_if_mapped_def cte_wp_at_caps_of_state) apply (wp (once) hoare_drop_imp) apply (wp arch_update_cap_invs_map) apply (rule hoare_vcg_conj_lift) apply (rule hoare_lift_Pf[where f=vs_lookup, OF _ set_cap.vs_lookup]) apply (rule_tac f="valid_pte xa" in hoare_lift_Pf[OF _ set_cap_valid_pte_stronger]) apply wp apply (rule hoare_lift_Pf2[where f=vs_lookup, OF _ set_cap.vs_lookup]) apply (wpsimp wp: dmo_ccr_invs arch_update_cap_invs_map hoare_vcg_const_Ball_lift
                         hoare_vcg_const_imp_lift hoare_vcg_all_lift set_cap_typ_at
                         hoare_vcg_ex_lift hoare_vcg_ball_lift set_cap_arch_obj set_cap.vs_lookup
              | simp add: same_refs_def del: fun_upd_apply)+ apply (wp (once) hoare_drop_imp) apply (wp arch_update_cap_invs_map hoare_vcg_ex_lift set_cap_arch_obj) apply (clarsimp simp: valid_page_inv_def cte_wp_at_caps_of_state neq_Nil_conv
                           valid_slots_def empty_refs_def parent_for_refs_def
                 simp del: fun_upd_apply del: exE split: sum.splits) apply (rule conjI) apply (fastforce simp: same_refs_def) apply clarsimp apply (rule conjI) apply (rule_tac x=aa in exI, rule_tac x=ba in exI) apply (rule conjI) apply (clarsimp simp: is_arch_update_def is_pt_cap_def is_pg_cap_def cap_master_cap_def image_def
                       split: Structures_A.cap.splits arch_cap.splits) apply (clarsimp simp: is_pt_cap_def cap_asid_def image_def neq_Nil_conv Collect_disj_eq
                      split: Structures_A.cap.splits arch_cap.splits option.splits) apply (rule conjI) apply (drule same_refs_lD) apply clarsimp apply fastforce apply (rule_tac x=aa in exI, rule_tac x=ba in exI) apply (clarsimp simp: is_arch_update_def cap_master_cap_def is_cap_simps
                     split: Structures_A.cap.splits arch_cap.splits) apply (rule conjI) apply (erule exEI) apply (clarsimp simp: same_refs_def) apply (rule conjI) apply clarsimp apply (rule_tac x=aa in exI, rule_tac x=ba in exI) apply (clarsimp simp: is_arch_update_def cap_master_cap_def is_cap_simps
                     split: Structures_A.cap.splits arch_cap.splits) apply (rule conjI) apply (rule_tac x=a in exI, rule_tac x=b in exI, rule_tac x=cap in exI) apply (clarsimp simp: same_refs_def) apply (rule conjI) apply (clarsimp simp: pde_at_def obj_at_def
                            caps_of_state_cteD'[where P=\<top>, simplified]) apply (drule_tac cap=capc and ptr="(aa,ba)"
                    in valid_global_refsD[OF invs_valid_global_refs]) apply assumption+ apply (clarsimp simp: cap_range_def) apply (clarsimp) apply (rule conjI) apply (clarsimp simp: pde_at_def obj_at_def a_type_def) apply (clarsimp split: Structures_A.kernel_object.split_asm
                            if_split_asm arch_kernel_obj.splits) apply (erule ballEI) apply (clarsimp simp: pde_at_def obj_at_def
                            caps_of_state_cteD'[where P=\<top>, simplified]) apply (drule_tac cap=capc and ptr="(aa,ba)"
                    in valid_global_refsD[OF invs_valid_global_refs]) apply assumption+ apply (drule_tac x=sl in imageI[where f="\<lambda>x. x && ~~ mask pd_bits"]) apply (drule (1) subsetD) apply (clarsimp simp: cap_range_def)

   \<comment> \<open>PageUnmap\<close> apply (rename_tac arch_cap cslot_ptr) apply (rule hoare_pre) apply (wp dmo_invs arch_update_cap_invs_unmap_page get_cap_wp
               hoare_vcg_const_imp_lift | wpc | simp)+ apply (rule_tac Q="\<lambda>_ s. invs s \<and>
                                cte_wp_at (\<lambda>c. is_pg_cap c \<and>
                                  (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow>
                                         \<not> (ref \<unrhd> obj_ref_of c) s)) cslot_ptr s"
                    in hoare_strengthen_post) prefer 2 apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps update_map_data_def
                              is_arch_update_def cap_master_cap_simps) apply (drule caps_of_state_valid, fastforce) apply (clarsimp simp: valid_cap_def cap_aligned_def vs_cap_ref_def
                       split: option.splits vmpage_size.splits cap.splits) apply (simp add: cte_wp_at_caps_of_state) apply (wp unmap_page_invs hoare_vcg_ex_lift hoare_vcg_all_lift
                 hoare_vcg_imp_lift unmap_page_unmapped)+ apply (clarsimp simp: valid_page_inv_def cte_wp_at_caps_of_state) apply (clarsimp simp: is_cap_simps cap_master_cap_simps is_arch_update_def update_map_data_def
                          cap_rights_update_def acap_rights_update_def) using valid_validate_vm_rights[simplified valid_vm_rights_def] apply (auto simp: valid_cap_def cap_aligned_def mask_def vs_cap_ref_def data_at_def
                    split: vmpage_size.splits option.splits if_splits)[1]

   \<comment> \<open>PageFlush\<close> apply (wpsimp wp: dmo_invs_lift set_vm_root_for_flush_invs) apply (simp add: valid_page_inv_def tcb_at_invs)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and valid_page_inv pg_inv\<rbrace> perform_page_invocation pg_inv \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and valid_page_inv pg_inv\<rbrace> case pg_inv of PageMap asid cap ct_slot entries \<Rightarrow> do set_cap cap ct_slot;
case entries of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od;
return []
od | PageUnmap (PageCap dev p R vp_size vp_mapped_addr) ct_slot \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap ct_slot;
set_cap (ArchObjectCap $ update_map_data cap None) ct_slot;
return []
od | PageUnmap _ ct_slot \<Rightarrow> fail | PageFlush typ start end pstart pd asid \<Rightarrow> do when (start < end) $ do root_switched <- set_vm_root_for_flush pd asid;
do_machine_op $ do_flush typ start end pstart;
when root_switched $ gets cur_thread >>= set_vm_root
od;
return []
od | PageGetAddr ptr \<Rightarrow> return [addrFromPPtr ptr] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>x11 x12 x13 x14. pg_inv = PageMap x11 x12 x13 x14 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageMap x11 x12 x13 x14)\<rbrace> do y <- set_cap x12 x13;
y <- case x14 of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid x11 else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid x11 else return ()
od;
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap cslot_ptr sum. pg_inv = PageMap asid cap cslot_ptr sum \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageMap asid cap cslot_ptr sum)\<rbrace> do y <- set_cap cap cslot_ptr;
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od;
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageMap asid cap (a, b) sum)\<rbrace> do y <- set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od;
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?Q5 asid cap a b sum\<rbrace> do y <- set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid asid else return ()
od;
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> ?Q5 asid cap a b sum s
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P214 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. ako_at (PageTable pt) (hd xb && ~~ mask pt_bits) s \<longrightarrow> invs s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> wellformed_pte xa \<and> (\<exists>a b asid. caps_of_state s (a, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 2. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 3. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. ?P214 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P214 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. invs s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> wellformed_pte xa \<and> (\<exists>a b asid. caps_of_state s (a, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 2. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 3. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. ?P214 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P'228 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> wellformed_pte xa \<and> (\<exists>a b asid. caps_of_state s (a, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 2. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 3. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ?P'228 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P234 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s\<rbrace>
 2. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P'233 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. wellformed_pte xa \<and> (\<exists>a b asid. caps_of_state s (a, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 3. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 4. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ?P234 asid cap a b sum x xa xb xc s \<and> ?P'233 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 5. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>asid cap a b xa xb pt x. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>\<lambda>s. (\<exists>ref. (ref, hd xb && ~~ mask pt_bits) \<in> x) \<longrightarrow> valid_pte xa s\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_ a. (\<exists>ref. (ref, hd xb && ~~ mask pt_bits) \<in> x) \<longrightarrow> valid_pte xa a\<rbrace>
 2. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P'233 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. wellformed_pte xa \<and> (\<exists>a b asid. caps_of_state s (a, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 3. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 4. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> ?P'233 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 5. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>asid cap a b xa xb pt x xc. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>\<lambda>s. (\<exists>ref. (ref, hd xb && ~~ mask pt_bits) \<in> x) \<longrightarrow> xc\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_ a. (\<exists>ref. (ref, hd xb && ~~ mask pt_bits) \<in> x) \<longrightarrow> xc\<rbrace>
 2. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P'233 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. wellformed_pte xa \<and> (\<exists>a b asid. caps_of_state s (a, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 3. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 4. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> ?P'233 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 5. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b xa xb pt. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?P'233 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb pt\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. wellformed_pte xa \<and> (\<exists>a b asid. caps_of_state s (a, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 2. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 3. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> ?P'233 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b xa xb pt x. pg_inv = PageMap asid cap (a, b) (Inl (xa, xb)) \<Longrightarrow> \<lbrace>?Q262 asid cap a b xa xb pt x\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_ a. wellformed_pte xa \<and> (\<exists>aa b asid. caps_of_state a (aa, b) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) asid)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref, hd xb && ~~ mask pt_bits) \<in> x \<longrightarrow> (\<forall>q. pte_ref_pages xa = Some q \<longrightarrow> (\<exists>aa b cap. caps_of_state a (aa, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>aa b cap. caps_of_state a (aa, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs cap \<and> is_pt_cap cap)\<rbrace>
 2. \<And>asid cap a b sum. pg_inv = PageMap asid cap (a, b) sum \<Longrightarrow> \<lbrace>?P'208 asid cap a b sum\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. \<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2))) \<noteq> InvalidPDE \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs sum cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs sum cap s) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))\<rbrace>
 3. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> ?P'233 asid cap a b sum x xa xb xc s))) \<and> ?P'208 asid cap a b sum s
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace>
flex-flex pairs:
\<lambda>asid cap a b xa xb pt s. ?Q262 asid cap a b xa xb pt (vs_lookup s) s \<equiv>\<^sup>? \<lambda>asid cap a b xa xb. ?P'233 asid cap a b (Inl (xa, xb)) (xa, xb) xa xb proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b xa xb pd. pg_inv = PageMap asid cap (a, b) (Inr (xa, xb)) \<Longrightarrow> \<lbrace>?P383 asid cap a b (Inr (xa, xb)) (xa, xb) xa xb pd\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs (Inr (xa, xb)) cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> (\<exists>p. pde_ref_pages xa = Some p \<and> p \<in> obj_refs cap) \<and> (case xb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref cap = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)\<rbrace>
 2. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>x. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> wellformed_pte xa \<and> (\<exists>x xc xd. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xc) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) xd)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. xd = Some (a, b)))) \<and> (\<forall>x. (x \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xc. pte_ref_pages xa = Some xc \<longrightarrow> (\<exists>xa xd xe. ((caps_of_state s)((a, b) \<mapsto> cap)) (xa, xd) = Some xe \<and> xc \<in> obj_refs xe \<and> vs_cap_ref xe = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # x)))) \<and> (\<exists>x xa xc. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xc \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs xc \<and> is_pt_cap xc)))) \<and> (\<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. ?P383 asid cap a b sum x xa xb xc s)))
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b xa xb pd. pg_inv = PageMap asid cap (a, b) (Inr (xa, xb)) \<Longrightarrow> \<lbrace>?P383 asid cap a b (Inr (xa, xb)) (xa, xb) xa xb pd\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>rv s. invs s \<and> (\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> parent_for_refs (Inr (xa, xb)) cap) \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap \<and> (\<exists>p. pde_ref_pages xa = Some p \<and> p \<in> obj_refs cap) \<and> (case xb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref cap = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. xb = hd xb # xs) \<and> (\<exists>pd. ako_at (PageDirectory pd) (hd xb && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s)\<rbrace>
 2. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>x. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> wellformed_pte xa \<and> (\<exists>x xc xd. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xc) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) xd)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. xd = Some (a, b)))) \<and> (\<forall>x. (x \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xc. pte_ref_pages xa = Some xc \<longrightarrow> (\<exists>xa xd xe. ((caps_of_state s)((a, b) \<mapsto> cap)) (xa, xd) = Some xe \<and> xc \<in> obj_refs xe \<and> vs_cap_ref xe = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # x)))) \<and> (\<exists>x xa xc. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xc \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs xc \<and> is_pt_cap xc)))) \<and> (\<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>xc. ?P383 asid cap a b sum x xa xb xc s)))
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b sum s. \<lbrakk>pg_inv = PageMap asid cap (a, b) sum; (invs and valid_page_inv (PageMap asid cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (\<forall>x. sum = Inl x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>x. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> ((\<exists>ref. (ref \<rhd> (hd xb && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte xa s) \<and> wellformed_pte xa \<and> (\<exists>x xc xd. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xc) = Some (ArchObjectCap (PageTableCap (hd xb && ~~ mask pt_bits) xd)) \<and> (xa = InvalidPTE \<or> (\<exists>a b. xd = Some (a, b)))) \<and> (\<forall>x. (x \<rhd> (hd xb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xc. pte_ref_pages xa = Some xc \<longrightarrow> (\<exists>xa xd xe. ((caps_of_state s)((a, b) \<mapsto> cap)) (xa, xd) = Some xe \<and> xc \<in> obj_refs xe \<and> vs_cap_ref xe = Some (VSRef (hd xb && mask pt_bits >> 2) (Some APageTable) # x)))) \<and> (\<exists>x xa xc. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xc \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl xb) \<subseteq> obj_refs xc \<and> is_pt_cap xc)))) \<and> (\<forall>x. sum = Inr x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>x. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and (\<lambda>a. a \<turnstile> cap)) s \<and> (\<exists>x. (x \<rhd> (hd xb && ~~ mask pd_bits)) s) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> parent_for_refs sum xb) \<and> (\<exists>x xc xd. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xc) = Some xd \<and> is_pg_cap xd \<and> (\<exists>x. pde_ref_pages xa = Some x \<and> x \<in> obj_refs xd) \<and> (case xb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xd = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> valid_pde xa s \<and> hd xb && ~~ mask pd_bits \<notin> global_refs s \<and> wellformed_pde xa \<and> pde_ref xa = None \<and> UCAST(32 \<rightarrow> 12) (hd xb && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>x. xb = hd xb # x) \<and> (\<exists>x. (ako_at (PageDirectory x) (hd xb && ~~ mask pd_bits) and cte_wp_at (\<lambda>_. True) (a, b)) s) \<and> (\<forall>sl\<in>set (tl xb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl xb). sl && ~~ mask pd_bits \<notin> global_refs s))))
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inl (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inl (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pt_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some (ArchObjectCap (PageTableCap (hd bb && ~~ mask pt_bits) xb)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. xb = Some (a, b)))) \<and> (\<forall>x. (x \<rhd> (hd bb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc xd. ((caps_of_state s)((a, b) \<mapsto> cap)) (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (hd bb && mask pt_bits >> 2) (Some APageTable) # x)))) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl bb) \<subseteq> obj_refs xb \<and> is_pt_cap xb)
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inl (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inl (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pt_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inl (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inl (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pt_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some (ArchObjectCap (PageTableCap (hd bb && ~~ mask pt_bits) xb)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. xb = Some (a, b)))) \<and> (\<forall>x. (x \<rhd> (hd bb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc xd. ((caps_of_state s)((a, b) \<mapsto> cap)) (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (hd bb && mask pt_bits >> 2) (Some APageTable) # x)))) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl bb) \<subseteq> obj_refs xb \<and> is_pt_cap xb)
 3. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inl (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inl (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pt_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some (ArchObjectCap (PageTableCap (hd bb && ~~ mask pt_bits) xb)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. xb = Some (a, b)))) \<and> (\<forall>x. (x \<rhd> (hd bb && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc xd. ((caps_of_state s)((a, b) \<mapsto> cap)) (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (hd bb && mask pt_bits >> 2) (Some APageTable) # x)))) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set (tl bb) \<subseteq> obj_refs xb \<and> is_pt_cap xb)
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (\<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<exists>x. cap = ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) x) \<and> (ab = InvalidPTE \<or> (\<exists>a b. x = Some (a, b))))) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) xb)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. xb = Some (a, b)))))) \<and> (\<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))) \<and> (\<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb)))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<exists>x. cap = ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) x) \<and> (ab = InvalidPTE \<or> (\<exists>a b. x = Some (a, b))))) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some (ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) xb)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. xb = Some (a, b)))))
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (\<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))) \<and> (\<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb)))
 3. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (aa = a \<and> ba = b \<longrightarrow> (\<exists>x. cap = ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) x) \<and> (ab = InvalidPTE \<or> (\<exists>a b. x = Some (a, b))))) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (\<exists>x. caps_of_state s (aa, ba) = Some (ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) x)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. x = Some (a, b)))))
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (\<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))) \<and> (\<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb)))
 3. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> aa = a \<and> ba = b \<longrightarrow> (\<exists>x. cap = ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) x) \<and> (ab = InvalidPTE \<or> (\<exists>a b. x = Some (a, b))))
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (\<exists>x. caps_of_state s (aa, ba) = Some (ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) x)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. x = Some (a, b))))
 3. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (\<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))) \<and> (\<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb)))
 4. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 5. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (\<exists>x. caps_of_state s (aa, ba) = Some (ArchObjectCap (PageTableCap (y && ~~ mask pt_bits) x)) \<and> (ab = InvalidPTE \<or> (\<exists>a b. x = Some (a, b))))
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (\<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))) \<and> (\<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb)))
 3. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (\<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))) \<and> (\<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb)))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb))
 3. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; (\<exists>p. pte_ref_pages ab = Some p \<and> p \<in> obj_refs cap) \<and> (\<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref))\<rbrakk> \<Longrightarrow> \<forall>x. (x \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>xa. pte_ref_pages ab = Some xa \<longrightarrow> (\<exists>xb xc. (xb = a \<and> xc = b \<longrightarrow> xa \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)) \<and> ((xb = a \<longrightarrow> xc \<noteq> b) \<longrightarrow> (\<exists>xd. caps_of_state s (xb, xc) = Some xd \<and> xa \<in> obj_refs xd \<and> vs_cap_ref xd = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x)))))
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb))
 3. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref x p. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; \<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref); p \<in> obj_refs cap; (x \<rhd> (y && ~~ mask pt_bits)) s; pte_ref_pages ab = Some p\<rbrakk> \<Longrightarrow> \<exists>xa xb. (xa = a \<longrightarrow> xb \<noteq> b) \<longrightarrow> (\<exists>xc. caps_of_state s (xa, xb) = Some xc \<and> p \<in> obj_refs xc \<and> vs_cap_ref xc = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # x))
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb))
 3. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<exists>x xa. (x = a \<and> xa = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inl (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inl (ab, y # ys)) capa s; same_refs (Inl (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pte ab; valid_pte ab s; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pt_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pt_bits)) s; y && ~~ mask pt_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capc; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> (aa = a \<and> ba = b \<longrightarrow> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (\<exists>x. caps_of_state s (aa, ba) = Some x \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs x \<and> is_pt_cap x))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa \<and> (\<forall>r. vs_cap_ref capa = Some r \<longrightarrow> vs_cap_ref cap = Some r)
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb x. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s; caps_of_state s (a, b) = Some x \<and> is_arch_update cap x\<rbrakk> \<Longrightarrow> caps_of_state s (a, b) = Some x \<and> is_arch_update cap x \<and> (\<forall>r. vs_cap_ref x = Some r \<longrightarrow> vs_cap_ref cap = Some r)
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)) \<and> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> \<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<exists>x xa. (x = a \<and> xa = b \<longrightarrow> y && ~~ mask pd_bits \<in> obj_refs cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y)) \<and> ((x = a \<longrightarrow> xa \<noteq> b) \<longrightarrow> (\<exists>xb. caps_of_state s (x, xa) = Some xb \<and> y && ~~ mask pd_bits \<in> obj_refs xb \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pd_cap xb \<and> (\<exists>y. cap_asid xb = Some y)))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> (aa = a \<and> ba = b \<longrightarrow> y && ~~ mask pd_bits \<in> obj_refs cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y)) \<and> ((aa = a \<longrightarrow> ba \<noteq> b) \<longrightarrow> (\<exists>x. caps_of_state s (aa, ba) = Some x \<and> y && ~~ mask pd_bits \<in> obj_refs x \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs x \<and> is_pd_cap x \<and> (\<exists>y. cap_asid x = Some y)))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))) \<and> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> \<exists>x xa xb. ((caps_of_state s)((a, b) \<mapsto> cap)) (x, xa) = Some xb \<and> is_pg_cap xb \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs xb) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref xb = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> ((caps_of_state s)((a, b) \<mapsto> cap)) (a, b) = Some cap \<and> is_pg_cap cap \<and> (\<exists>x. pde_ref_pages ab = Some x \<and> x \<in> obj_refs cap) \<and> (case bb of [] \<Rightarrow> True | x # xs \<Rightarrow> \<forall>ref. (ref \<rhd> (x && ~~ mask pd_bits)) s \<longrightarrow> vs_cap_ref cap = Some (VSRef (x && mask pd_bits >> 2) (Some APageDirectory) # ref))
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> hd bb && ~~ mask pd_bits \<notin> global_refs s \<and> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> hd bb && ~~ mask pd_bits \<notin> global_refs s
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa capb y aa pd ys ba capc ya ref pda. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> same_refs (Inr (ab, y # ys)) cap s); same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; cte_wp_at ((=) capa) (a, b) s; is_arch_update cap capa; cte_wp_at ((=) capb) (a, b) s; is_pg_cap capb; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; y && ~~ mask pd_bits \<in> global_refs s; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; is_aligned y 2; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> (\<exists>ko. kheap s (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> False
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>asid cap a b s ab capa capb y aa pd ys ba capc ya ref pda. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> same_refs (Inr (ab, y # ys)) cap s); same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; cte_wp_at ((=) capa) (a, b) s; is_arch_update cap capa; cte_wp_at ((=) capb) (a, b) s; is_pg_cap capb; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; y && ~~ mask pd_bits \<in> global_refs s; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; is_aligned y 2; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> (\<exists>ko. kheap s (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capc) (aa, ba) s
 2. \<And>asid cap a b s ab capa capb y aa pd ys ba capc ya ref pda. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> same_refs (Inr (ab, y # ys)) cap s); same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; cte_wp_at ((=) capa) (a, b) s; is_arch_update cap capa; cte_wp_at ((=) capb) (a, b) s; is_pg_cap capb; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; y && ~~ mask pd_bits \<in> global_refs s; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; is_aligned y 2; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> (\<exists>ko. kheap s (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> ?r1704 asid cap a b s ab capa capb y aa pd ys ba capc ya ref pda \<in> global_refs s
 3. \<And>asid cap a b s ab capa capb y aa pd ys ba capc ya ref pda. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> same_refs (Inr (ab, y # ys)) cap s); same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; cte_wp_at ((=) capa) (a, b) s; is_arch_update cap capa; cte_wp_at ((=) capb) (a, b) s; is_pg_cap capb; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; y && ~~ mask pd_bits \<in> global_refs s; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; is_aligned y 2; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> (\<exists>ko. kheap s (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; ?r1704 asid cap a b s ab capa capb y aa pd ys ba capc ya ref pda \<notin> cap_range capc\<rbrakk> \<Longrightarrow> False
 4. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 5. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa capb y aa pd ys ba capc ya ref pda. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. cte_wp_at ((=) cap) (a, b) s \<and> same_refs (Inr (ab, y # ys)) cap s); same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; cte_wp_at ((=) capa) (a, b) s; is_arch_update cap capa; cte_wp_at ((=) capb) (a, b) s; is_pg_cap capb; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; y && ~~ mask pd_bits \<in> global_refs s; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; is_aligned y 2; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> (\<exists>ko. kheap s (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; y && ~~ mask pd_bits \<notin> cap_range capc\<rbrakk> \<Longrightarrow> False
 2. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab bb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, bb)); invs s; \<exists>capa. caps_of_state s (a, b) = Some capa \<and> is_arch_update cap capa; (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> vs_cap_ref cap = None) \<or> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> same_refs (Inr (ab, bb)) cap s); \<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_pg_cap cap; same_refs (Inr (ab, bb)) cap s; \<exists>y ys. bb = y # ys; s \<turnstile> cap; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set bb \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y); \<exists>pd. vspace_at_asid asid pd s\<rbrakk> \<Longrightarrow> (\<exists>x. bb = hd bb # x) \<and> (\<exists>x. ako_at (PageDirectory x) (hd bb && ~~ mask pd_bits) s) \<and> (\<exists>cap. caps_of_state s (a, b) = Some cap) \<and> (\<forall>sl\<in>set (tl bb). UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits \<notin> global_refs s)
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> (\<exists>x. ako_at (PageDirectory x) (y && ~~ mask pd_bits) s) \<and> (\<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s)
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<exists>x. ako_at (PageDirectory x) (y && ~~ mask pd_bits) s
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref ko. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> (\<exists>ko. kheap s (p && ~~ mask pd_bits) = Some ko \<and> (case ko of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_aligned y 2; kheap s (y && ~~ mask pd_bits) = Some ko; (case ko of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory\<rbrakk> \<Longrightarrow> \<exists>x. ko = ArchObj (PageDirectory x)
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s
 3. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; caps_of_state s (a, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; sl \<in> set ys; (\<exists>ref. (ref \<rhd> (sl && ~~ mask pd_bits)) s) \<and> pde_at sl s \<and> UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> sl && ~~ mask pd_bits \<notin> global_refs s
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); invs s; vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; cte_wp_at ((=) capa) (a, b) s; is_pg_cap capa; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; sl \<in> set ys; is_aligned y 2; (refa \<rhd> (sl && ~~ mask pd_bits)) s; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned sl 2; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap s (sl && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); sl && ~~ mask pd_bits \<in> global_refs s\<rbrakk> \<Longrightarrow> False
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; cte_wp_at ((=) capa) (a, b) s; is_pg_cap capa; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; sl \<in> set ys; is_aligned y 2; (refa \<rhd> (sl && ~~ mask pd_bits)) s; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned sl 2; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap s (sl && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); sl && ~~ mask pd_bits \<in> global_refs s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capc) (aa, ba) s
 2. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; cte_wp_at ((=) capa) (a, b) s; is_pg_cap capa; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; sl \<in> set ys; is_aligned y 2; (refa \<rhd> (sl && ~~ mask pd_bits)) s; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned sl 2; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap s (sl && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); sl && ~~ mask pd_bits \<in> global_refs s\<rbrakk> \<Longrightarrow> ?r1910 asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb \<in> global_refs s
 3. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; cte_wp_at ((=) capa) (a, b) s; is_pg_cap capa; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; sl \<in> set ys; is_aligned y 2; (refa \<rhd> (sl && ~~ mask pd_bits)) s; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned sl 2; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap s (sl && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); sl && ~~ mask pd_bits \<in> global_refs s; ?r1910 asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb \<notin> cap_range capc\<rbrakk> \<Longrightarrow> False
 4. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; cte_wp_at ((=) capa) (a, b) s; is_pg_cap capa; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; sl \<in> set ys; is_aligned y 2; (refa \<rhd> (sl && ~~ mask pd_bits)) s; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned sl 2; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap s (sl && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); sl && ~~ mask pd_bits \<in> global_refs s; sl && ~~ mask pd_bits \<notin> cap_range capc\<rbrakk> \<Longrightarrow> False
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; cte_wp_at ((=) capa) (a, b) s; is_pg_cap capa; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_aligned y 2; (refa \<rhd> (sl && ~~ mask pd_bits)) s; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned sl 2; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap s (sl && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); sl && ~~ mask pd_bits \<in> global_refs s; sl && ~~ mask pd_bits \<notin> cap_range capc; sl && ~~ mask pd_bits \<in> (\<lambda>x. x && ~~ mask pd_bits) ` set ys\<rbrakk> \<Longrightarrow> False
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asid cap a b s ab capa y aa pd ys ba capc ya ref sl refa pda pdb. \<lbrakk>pg_inv = PageMap asid cap (a, b) (Inr (ab, y # ys)); vs_cap_ref capa = None \<or> same_refs (Inr (ab, y # ys)) capa s; same_refs (Inr (ab, y # ys)) cap s; s \<turnstile> cap; is_pg_cap cap; wellformed_pde ab; valid_pde ab s; pde_ref ab = None; asid \<le> mask local.asid_bits; asid \<noteq> 0; vspace_at_asid asid pd s; is_arch_update cap capa; cte_wp_at ((=) capa) (a, b) s; is_pg_cap capa; cte_wp_at ((=) capc) (aa, ba) s; is_pd_cap capc; cap_asid capc = Some ya; (ref \<rhd> (y && ~~ mask pd_bits)) s; y && ~~ mask pd_bits \<in> obj_refs capc; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; is_aligned y 2; (refa \<rhd> (sl && ~~ mask pd_bits)) s; kheap s (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned sl 2; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap s (sl && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); sl && ~~ mask pd_bits \<in> global_refs s; sl && ~~ mask pd_bits \<notin> cap_range capc; sl && ~~ mask pd_bits \<in> (\<lambda>x. x && ~~ mask pd_bits) ` set ys; sl && ~~ mask pd_bits \<in> obj_refs capc\<rbrakk> \<Longrightarrow> False
 2. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x22. pg_inv = PageUnmap x21 x22 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap x21 x22)\<rbrace> case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap x22;
set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>arch_cap cslot_ptr. pg_inv = PageUnmap arch_cap cslot_ptr \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)\<rbrace> case arch_cap of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap cslot_ptr;
set_cap (ArchObjectCap $ update_map_data cap None) cslot_ptr;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>arch_cap cslot_ptr. pg_inv = PageUnmap arch_cap cslot_ptr \<Longrightarrow> \<lbrace>?Q1919 arch_cap cslot_ptr\<rbrace> case arch_cap of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap cslot_ptr;
set_cap (ArchObjectCap $ update_map_data cap None) cslot_ptr;
return []
od | _ \<Rightarrow> fail \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> ?Q1919 arch_cap cslot_ptr s
 3. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1997 (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>x s. \<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap (update_map_data (the_arch_cap cap) None)) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> ArchObjectCap (update_map_data (the_arch_cap cap) None) \<and> is_pg_cap (ArchObjectCap (update_map_data (the_arch_cap cap) None))\<rbrace>
 2. \<And>arch_cap cslot_ptr x41 x42. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?R1949 arch_cap cslot_ptr x41 x42\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>arch_cap cslot_ptr x51 x52. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?R1950 arch_cap cslot_ptr x51 x52\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R1997 arch_cap cslot_ptr x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> ?R1949 arch_cap cslot_ptr x xa s) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> ?R1950 arch_cap cslot_ptr x xa s)
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1997 (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>_ s. invs s \<and> cte_wp_at (\<lambda>c. is_pg_cap c \<and> (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, obj_ref_of c) \<notin> vs_lookup_pages s)) cslot_ptr s\<rbrace>
 2. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a rv s. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a); invs s \<and> cte_wp_at (\<lambda>c. is_pg_cap c \<and> (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, obj_ref_of c) \<notin> vs_lookup_pages s)) cslot_ptr s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap (update_map_data (the_arch_cap cap) None)) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> ArchObjectCap (update_map_data (the_arch_cap cap) None) \<and> is_pg_cap (ArchObjectCap (update_map_data (the_arch_cap cap) None))
 3. \<And>arch_cap cslot_ptr x41 x42. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?R1949 arch_cap cslot_ptr x41 x42\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>arch_cap cslot_ptr x51 x52. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?R1950 arch_cap cslot_ptr x51 x52\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R1997 arch_cap cslot_ptr x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> ?R1949 arch_cap cslot_ptr x xa s) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> ?R1950 arch_cap cslot_ptr x xa s)
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a rv s. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a); invs s \<and> cte_wp_at (\<lambda>c. is_pg_cap c \<and> (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, obj_ref_of c) \<notin> vs_lookup_pages s)) cslot_ptr s\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap (update_map_data (the_arch_cap cap) None)) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> ArchObjectCap (update_map_data (the_arch_cap cap) None) \<and> is_pg_cap (ArchObjectCap (update_map_data (the_arch_cap cap) None))
 2. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1997 (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>_ s. invs s \<and> cte_wp_at (\<lambda>c. is_pg_cap c \<and> (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, obj_ref_of c) \<notin> vs_lookup_pages s)) cslot_ptr s\<rbrace>
 3. \<And>arch_cap cslot_ptr x41 x42. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?R1949 arch_cap cslot_ptr x41 x42\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>arch_cap cslot_ptr x51 x52. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?R1950 arch_cap cslot_ptr x51 x52\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R1997 arch_cap cslot_ptr x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> ?R1949 arch_cap cslot_ptr x xa s) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> ?R1950 arch_cap cslot_ptr x xa s)
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a b x31 x32 x33 x34 x1 x2a s dev p R sz m. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) (a, b); invs s; \<forall>ref. vs_cap_ref (ArchObjectCap (PageCap dev p R sz m)) = Some ref \<longrightarrow> (ref, p) \<notin> vs_lookup_pages s; caps_of_state s (a, b) = Some (ArchObjectCap (PageCap dev p R sz m))\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageCap dev p R sz None)
 2. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1997 (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>_ s. invs s \<and> cte_wp_at (\<lambda>c. is_pg_cap c \<and> (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, obj_ref_of c) \<notin> vs_lookup_pages s)) cslot_ptr s\<rbrace>
 3. \<And>arch_cap cslot_ptr x41 x42. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?R1949 arch_cap cslot_ptr x41 x42\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>arch_cap cslot_ptr x51 x52. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?R1950 arch_cap cslot_ptr x51 x52\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R1997 arch_cap cslot_ptr x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> ?R1949 arch_cap cslot_ptr x xa s) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> ?R1950 arch_cap cslot_ptr x xa s)
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>a b x31 x32 x33 x34 x1 x2a s dev p R sz m. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) (a, b); invs s; \<forall>ref. vs_cap_ref (ArchObjectCap (PageCap dev p R sz m)) = Some ref \<longrightarrow> (ref, p) \<notin> vs_lookup_pages s; s \<turnstile> ArchObjectCap (PageCap dev p R sz m)\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageCap dev p R sz None)
 2. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1997 (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>_ s. invs s \<and> cte_wp_at (\<lambda>c. is_pg_cap c \<and> (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, obj_ref_of c) \<notin> vs_lookup_pages s)) cslot_ptr s\<rbrace>
 3. \<And>arch_cap cslot_ptr x41 x42. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?R1949 arch_cap cslot_ptr x41 x42\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>arch_cap cslot_ptr x51 x52. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?R1950 arch_cap cslot_ptr x51 x52\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 5. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R1997 arch_cap cslot_ptr x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> ?R1949 arch_cap cslot_ptr x xa s) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> ?R1950 arch_cap cslot_ptr x xa s)
 6. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 7. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1997 (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>_ s. invs s \<and> cte_wp_at (\<lambda>c. is_pg_cap c \<and> (\<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, obj_ref_of c) \<notin> vs_lookup_pages s)) cslot_ptr s\<rbrace>
 2. \<And>arch_cap cslot_ptr x41 x42. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?R1949 arch_cap cslot_ptr x41 x42\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>arch_cap cslot_ptr x51 x52. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?R1950 arch_cap cslot_ptr x51 x52\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R1997 arch_cap cslot_ptr x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> ?R1949 arch_cap cslot_ptr x xa s) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> ?R1950 arch_cap cslot_ptr x xa s)
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>arch_cap cslot_ptr x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>pg_inv = PageUnmap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr; arch_cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1997 (PageCap x31 x32 x33 x34 (Some (x1, x2a))) cslot_ptr x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>_ s. invs s \<and> (\<exists>cap. caps_of_state s cslot_ptr = Some cap \<and> is_pg_cap cap \<and> (\<forall>ref. vs_cap_ref cap = Some ref \<longrightarrow> (ref, obj_ref_of cap) \<notin> vs_lookup_pages s))\<rbrace>
 2. \<And>arch_cap cslot_ptr x41 x42. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?R1949 arch_cap cslot_ptr x41 x42\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>arch_cap cslot_ptr x51 x52. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; arch_cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>?R1950 arch_cap cslot_ptr x51 x52\<rbrace> fail \<lbrace>\<lambda>_. invs\<rbrace>
 4. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R1997 arch_cap cslot_ptr x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> ?R1949 arch_cap cslot_ptr x xa s) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> ?R1950 arch_cap cslot_ptr x xa s)
 5. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 6. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>arch_cap cslot_ptr s. \<lbrakk>pg_inv = PageUnmap arch_cap cslot_ptr; (invs and valid_page_inv (PageUnmap arch_cap cslot_ptr)) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. arch_cap = ASIDPoolCap x xa \<longrightarrow> True) \<and> (arch_cap = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd. arch_cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> (\<forall>cap. cte_wp_at ((=) cap) cslot_ptr s \<longrightarrow> ((\<lambda>cap s. cte_wp_at (\<lambda>c. (\<forall>p'\<in>obj_refs c. \<forall>ref. vs_cap_ref c = Some ref \<longrightarrow> (ref, p') \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap $ update_map_data cap None) c) cslot_ptr s \<and> invs s \<and> s \<turnstile> (ArchObjectCap $ update_map_data cap None) \<and> K (is_pg_cap (ArchObjectCap $ update_map_data cap None)) s) \<circ> the_arch_cap) cap s)) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>xb xd. x = (xb, xd) \<longrightarrow> (invs and K (xb \<le> mask local.asid_bits \<and> xd < kernel_base \<and> vmsz_aligned xd xc)) s \<and> (\<exists>x. caps_of_state s cslot_ptr = Some x \<and> is_pg_cap x \<and> (\<forall>xe. vs_cap_ref x \<noteq> Some xe \<or> (pspace_aligned and valid_vspace_objs and data_at xc xa and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and K ((xc = ARMSmallPage \<or> xc = ARMLargePage \<longrightarrow> xe = [VSRef ((xd >> 12) && mask 8) (Some APageTable), VSRef (xd >> 20) (Some APageDirectory), VSRef (xb && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None]) \<and> (xc = ARMSection \<or> xc = ARMSuperSection \<longrightarrow> xe = [VSRef (xd >> 20) (Some APageDirectory), VSRef (xb && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None]) \<and> obj_ref_of x = xa)) s))))) \<and> (\<forall>x xa. arch_cap = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>x xa. arch_cap = PageDirectoryCap x xa \<longrightarrow> True)
 2. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a b s x xa xb xc xd. \<lbrakk>pg_inv = PageUnmap (PageCap x xa xb xc xd) (a, b); invs s; case xd of None \<Rightarrow> True | Some x \<Rightarrow> valid_unmap xc x; caps_of_state s (a, b) = Some (ArchObjectCap (PageCap x xa xb xc xd)); s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)\<rbrakk> \<Longrightarrow> (xd = None \<longrightarrow> (\<forall>ref. vs_cap_ref (ArchObjectCap (PageCap x xa xb xc None)) = Some ref \<longrightarrow> (ref, xa) \<notin> vs_lookup_pages s) \<and> is_arch_update (ArchObjectCap (update_map_data (PageCap x xa xb xc None) None)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> s \<turnstile> ArchObjectCap (update_map_data (PageCap x xa xb xc None) None) \<and> is_pg_cap (ArchObjectCap (update_map_data (PageCap x xa xb xc None) None))) \<and> (\<forall>a b. xd = Some (a, b) \<longrightarrow> a \<le> mask local.asid_bits \<and> b < kernel_base \<and> vmsz_aligned b xc \<and> is_pg_cap (ArchObjectCap (PageCap x xa xb xc (Some (a, b)))) \<and> (\<forall>xd. vs_cap_ref (ArchObjectCap (PageCap x xa xb xc (Some (a, b)))) = Some xd \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> data_at xc xa s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<and> (xc = ARMSmallPage \<longrightarrow> xd = [VSRef ((b >> 12) && mask 8) (Some APageTable), VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMLargePage \<longrightarrow> xd = [VSRef ((b >> 12) && mask 8) (Some APageTable), VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMSection \<longrightarrow> xd = [VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMSuperSection \<longrightarrow> xd = [VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None])))
 2. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a b s x xa xb xc xd. \<lbrakk>pg_inv = PageUnmap (PageCap x xa xb xc xd) (a, b); invs s; case xd of None \<Rightarrow> True | Some x \<Rightarrow> valid_unmap xc x; caps_of_state s (a, b) = Some (ArchObjectCap (PageCap x xa xb xc xd)); s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)\<rbrakk> \<Longrightarrow> (xd = None \<longrightarrow> (\<forall>ref. vs_cap_ref (ArchObjectCap (PageCap x xa xb xc None)) = Some ref \<longrightarrow> (ref, xa) \<notin> vs_lookup_pages s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb xc None)) \<and> (\<forall>a b. xd = Some (a, b) \<longrightarrow> a \<le> mask local.asid_bits \<and> b < kernel_base \<and> vmsz_aligned b xc \<and> (\<forall>xd. vs_cap_ref (ArchObjectCap (PageCap x xa xb xc (Some (a, b)))) = Some xd \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> data_at xc xa s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<and> (xc = ARMSmallPage \<longrightarrow> xd = [VSRef ((b >> 12) && mask 8) (Some APageTable), VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMLargePage \<longrightarrow> xd = [VSRef ((b >> 12) && mask 8) (Some APageTable), VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMSection \<longrightarrow> xd = [VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMSuperSection \<longrightarrow> xd = [VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None])))
 2. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
using this:
validate_vm_rights ?rs \<in> {vm_read_write, vm_read_only, vm_kernel_only}

goal (3 subgoals):
 1. \<And>a b s x xa xb xc xd. \<lbrakk>pg_inv = PageUnmap (PageCap x xa xb xc xd) (a, b); invs s; case xd of None \<Rightarrow> True | Some x \<Rightarrow> valid_unmap xc x; caps_of_state s (a, b) = Some (ArchObjectCap (PageCap x xa xb xc xd)); s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)\<rbrakk> \<Longrightarrow> (xd = None \<longrightarrow> (\<forall>ref. vs_cap_ref (ArchObjectCap (PageCap x xa xb xc None)) = Some ref \<longrightarrow> (ref, xa) \<notin> vs_lookup_pages s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb xc None)) \<and> (\<forall>a b. xd = Some (a, b) \<longrightarrow> a \<le> mask local.asid_bits \<and> b < kernel_base \<and> vmsz_aligned b xc \<and> (\<forall>xd. vs_cap_ref (ArchObjectCap (PageCap x xa xb xc (Some (a, b)))) = Some xd \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> data_at xc xa s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<and> (xc = ARMSmallPage \<longrightarrow> xd = [VSRef ((b >> 12) && mask 8) (Some APageTable), VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMLargePage \<longrightarrow> xd = [VSRef ((b >> 12) && mask 8) (Some APageTable), VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMSection \<longrightarrow> xd = [VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None]) \<and> (xc = ARMSuperSection \<longrightarrow> xd = [VSRef (b >> 20) (Some APageDirectory), VSRef (a && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of a)) None])))
 2. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 3. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36. pg_inv = PageFlush x31 x32 x33 x34 x35 x36 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36)\<rbrace> do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pg_inv = PageFlush x31 x32 x33 x34 x35 x36; invs s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; x32 < x33\<rbrakk> \<Longrightarrow> x36 \<le> mask local.asid_bits
 2. \<And>x4. pg_inv = PageGetAddr x4 \<Longrightarrow> \<lbrace>invs and valid_page_inv (PageGetAddr x4)\<rbrace> return [addrFromPPtr x4] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal:
No subgoals!