theory VSpace_R

lemma unmapPage_corres:
  "corres dc (invs and valid_etcbs and
              K (valid_unmap sz (asid,vptr) \<and> vptr < kernel_base \<and> asid \<le> mask asid_bits))
             (valid_objs' and valid_arch_state' and pspace_aligned' and
              pspace_distinct' and no_0_obj' and cur_tcb')
             (unmap_page sz asid vptr pptr)
             (unmapPage sz asid vptr pptr)" apply (clarsimp simp: unmap_page_def unmapPage_def ignoreFailure_def const_def  largePagePTEOffsets_def) apply (rule corres_guard_imp) apply (rule corres_split_catch [where E="\<lambda>_. \<top>" and E'="\<lambda>_. \<top>"]) apply (rule corres_split_strengthen_ftE[where ftr'=dc],
              rule find_pd_for_asid_corres,simp) apply (rule corres_splitEE) prefer 2 apply clarsimp apply (rule flushPage_corres) apply (rule_tac F = "vptr < kernel_base" in corres_gen_asm) apply (rule_tac P="\<exists>\<rhd> pd and page_directory_at pd and vspace_at_asid asid pd
                              and (\<exists>\<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits))
                              and valid_arch_state and valid_vspace_objs
                              and equal_kernel_mappings
                              and pspace_aligned and valid_global_objs and valid_etcbs and
                              K (valid_unmap sz (asid,vptr) )" and
                           P'="pspace_aligned' and pspace_distinct'" in corres_inst) apply clarsimp apply (rename_tac pd) apply (cases sz, simp_all)[1] apply (rule corres_guard_imp) apply (rule_tac F = "vptr < kernel_base" in corres_gen_asm) apply (rule corres_split_strengthen_ftE[OF lookupPTSlot_corres[OF refl refl]]) apply simp apply (rule corres_splitEE[OF checkMappingPPtr_corres]) apply simp apply (rule corres_split) apply (rule storePTE_corres') apply (simp add: pte_relation_aligned_def) apply (rule corres_machine_op) apply (rule corres_Id, rule refl, simp) apply (rule no_fail_cleanByVA_PoU) apply (wpsimp wp: hoare_drop_imps lookup_pt_slot_inv
                                       lookupPTSlot_inv lookup_pt_slot_is_aligned)+ apply (clarsimp simp: page_directory_pde_at_lookupI
                                     page_directory_at_aligned_pd_bits vmsz_aligned_def) apply (simp add:valid_unmap_def pageBits_def) apply (erule less_kernel_base_mapping_slots) apply (simp add:page_directory_at_aligned_pd_bits) apply simp apply (rule corres_guard_imp) apply (rule corres_split_strengthen_ftE[OF lookupPTSlot_corres[OF refl refl]]) apply (rule_tac F="is_aligned p 6" in corres_gen_asm) apply (simp add: is_aligned_mask[symmetric]) apply (rule corres_split_strengthen_ftE[OF checkMappingPPtr_corres]) apply (simp add: largePagePTEOffsets_def pteBits_def) apply (rule corres_split) apply (rule corres_mapM) prefer 7 apply (rule order_refl) apply simp apply simp apply clarsimp apply (rule_tac P="(\<lambda>s. \<forall>x\<in>set [0, 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs"
                                     and P'="pspace_aligned' and pspace_distinct'"
                                      in corres_guard_imp) apply (rule storePTE_corres',  simp add:pte_relation_aligned_def) apply clarsimp apply clarsimp apply (wpsimp wp: store_pte_typ_at hoare_vcg_const_Ball_lift)+ apply (rule corres_machine_op) apply (clarsimp simp: last_byte_pte_def objBits_simps archObjSize_def) apply (rule corres_Id, rule refl, simp) apply (rule no_fail_cleanCacheRange_PoU) apply (wp hoare_drop_imps | simp)+ apply (wp lookup_pt_slot_ptes lookup_pt_slot_inv lookupPTSlot_inv
                          lookup_pt_slot_is_aligned lookup_pt_slot_is_aligned_6)+ apply (clarsimp simp: page_directory_pde_at_lookupI vmsz_aligned_def pd_aligned
                                    pd_bits_def pageBits_def valid_unmap_def) apply (drule(1) less_kernel_base_mapping_slots[OF _ page_directory_at_aligned_pd_bits]) apply simp apply (simp add:pd_bits_def pageBits_def) apply (clarsimp simp: pd_aligned page_directory_pde_at_lookupI) apply (rule corres_guard_imp) apply (rule corres_split_strengthen_ftE[OF checkMappingPPtr_corres]) apply simp apply (rule corres_split) apply (rule storePDE_corres') apply (simp add:pde_relation_aligned_def) apply (rule corres_machine_op) apply (rule corres_Id, rule refl, simp) apply (rule no_fail_cleanByVA_PoU) apply (wp | simp | wp (once) hoare_drop_imps)+ apply (clarsimp simp: page_directory_pde_at_lookupI
                                   pg_entry_align_def) apply (clarsimp simp:lookup_pd_slot_def) apply (erule(1) aligned_add_aligned[OF page_directory_at_aligned_pd_bits]) apply (simp add:is_aligned_shiftl_self) apply (simp add:pd_bits_def pageBits_def word_bits_conv) apply (simp add:pd_bits_def pageBits_def) apply (rule corres_guard_imp) apply (rule corres_split_strengthen_ftE[OF checkMappingPPtr_corres]) apply (rule_tac F="is_aligned (lookup_pd_slot pd vptr) 6"
                             in corres_gen_asm) apply (simp add: is_aligned_mask[symmetric]) apply (rule corres_split) apply (rule_tac P="page_directory_at pd and pspace_aligned and valid_etcbs
                                        and K (valid_unmap sz (asid, vptr))"
                              in corres_mapM [where r=dc], simp, simp) prefer 5 apply (rule order_refl) apply (clarsimp simp: superSectionPDEOffsets_def pdeBits_def) apply (rule corres_guard_imp, rule storePDE_corres') apply (simp add:pde_relation_aligned_def)+ apply clarsimp apply (erule (2) pde_at_aligned_vptr) apply (simp add: valid_unmap_def) apply assumption apply (wp | simp add: superSectionPDEOffsets_def pdeBits_def)+ apply (rule corres_machine_op) apply (clarsimp simp: last_byte_pde_def objBits_simps archObjSize_def
                                       superSectionPDEOffsets_def pdeBits_def) apply (rule corres_Id, rule refl, simp) apply (rule no_fail_cleanCacheRange_PoU) apply (wp hoare_drop_imps)+ apply (clarsimp simp: valid_unmap_def page_directory_pde_at_lookupI
                                  lookup_pd_slot_aligned_6 pg_entry_align_def
                                  pd_aligned vmsz_aligned_def) apply simp apply wp apply (rule_tac Q'="\<lambda>_. invs and vspace_at_asid asid pda" in hoare_post_imp_R) apply (wp lookup_pt_slot_inv lookup_pt_slot_cap_to2' lookup_pt_slot_cap_to_multiple2
                     store_pde_invs_unmap store_pde_pd_at_asid mapM_swp_store_pde_invs_unmap
                | wpc | simp | wp hoare_drop_imps
                | wp mapM_wp')+ apply (fastforce simp: invs_vspace_objs[simplified]) apply (wp lookupPTSlot_inv mapM_wp' | wpc | clarsimp)+ apply (wp hoare_vcg_const_imp_lift_R
             | strengthen lookup_pd_slot_kernel_mappings_strg not_in_global_refs_vs_lookup
               page_directory_at_lookup_mask_aligned_strg lookup_pd_slot_kernel_mappings_set_strg
               page_directory_at_lookup_mask_add_aligned_strg
             | wp hoare_vcg_const_Ball_lift_R
             | simp)+ apply (clarsimp simp add: valid_unmap_def valid_asid_def) apply (case_tac sz) apply (auto simp: invs_def valid_state_def
        valid_arch_state_def pageBits_def
        valid_arch_caps_def vmsz_aligned_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_etcbs and K (valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') (unmap_page sz asid vptr pptr) (unmapPage sz asid vptr pptr) proof (prove)
goal (1 subgoal):
 1. corres dc (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') (doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE <catch> (\<lambda>y. return ())) (doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE <catch> (\<lambda>y. return ())) proof (prove)
goal (3 subgoals):
 1. corres dc ?Q ?Q' (doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE <catch> (\<lambda>y. return ())) (doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ?Q s
 3. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> ?Q' s proof (prove)
goal (6 subgoals):
 1. corres (?f4 \<oplus> dc) ?P4 ?P'4 (doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE) (doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE)
 2. \<And>y ya. ?f4 y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 3. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> (?P4 and ?Q4) s
 6. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>pd pda. pd = pda \<Longrightarrow> corres (dc \<oplus> dc) (?R9 pd) (?R'9 pda) (doE y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE) (doE y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pda asid vptr)
odE)
 2. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>?R9\<rbrace>, -
 3. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>?R'9\<rbrace>, -
 4. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 5. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 8. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (11 subgoals):
 1. \<And>pd pda. pd = pda \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pda) (?P17 pd) (?P'19 pda) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 2. \<And>pd pda y ya. \<lbrakk>pd = pda; ?r'16 pd pda y ya\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R16 pd pda y) (?R'16 pd pda ya) (liftE (flush_page sz pd asid vptr)) (liftE (flushPage sz pda asid vptr))
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>?R16 pd pda\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>?R'16 pd pda\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. ?P17 pd and ?Q18 pd\<rbrace>, -
 6. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. ?P'19 pda and ?Q'20 pda\<rbrace>, -
 7. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 8. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pd pda y ya. \<lbrakk>pd = pda; ?r'16 pd pda y ya\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R16 pd pda y) (?R'16 pd pda ya) (liftE (flush_page sz pd asid vptr)) (liftE (flushPage sz pda asid vptr))
 2. \<And>pd pda. pd = pda \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pda) (?P17 pd) (?P'19 pda) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>?R16 pd pda\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>?R'16 pd pda\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. ?P17 pd and ?Q18 pd\<rbrace>, -
 6. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. ?P'19 pda and ?Q'20 pda\<rbrace>, -
 7. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 8. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pd. ?r'16 pd pd () () \<Longrightarrow> corres dc (?R16 pd pd ()) (?R'16 pd pd ()) (flush_page sz pd asid vptr) (flushPage sz pd asid vptr)
 2. \<And>pd pda. pd = pda \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pda) (?P17 pd) (?P'19 pda) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>?R16 pd pda\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>?R'16 pd pda\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. ?P17 pd and ?Q18 pd\<rbrace>, -
 6. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. ?P'19 pda and ?Q'20 pda\<rbrace>, -
 7. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 8. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>pd pda. pd = pda \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pda) (?P17 pd) (?P'19 pda) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. ?P17 pd and ?Q18 pd\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. ?P'19 pda and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>pd pda. \<lbrakk>pd = pda; vptr < kernel_base\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pda) (?P30 pd) (?P'19 pda) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. ?P30 pd and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. ?P'19 pda and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>pd pda. \<lbrakk>pd = pda; vptr < kernel_base\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pda) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr))) (pspace_aligned' and pspace_distinct') (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>pd. vptr < kernel_base \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr))) (pspace_aligned' and pspace_distinct') (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>pd. vptr < kernel_base \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr))) (pspace_aligned' and pspace_distinct') (case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE) (case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE)
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (13 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p ARM_A.InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMSmallPage (Inl p);
liftE (do y <- storePTE p ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU p (addrFromPPtr p))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 8. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 9. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 10. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) (?Q37 pd) (?Q'37 pd) (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p ARM_A.InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMSmallPage (Inl p);
liftE (do y <- storePTE p ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU p (addrFromPPtr p))
od)
odE)
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> ?Q37 pd s
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ?Q'37 pd s
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 10. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) (?P41 pd) (?Q'37 pd) (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p ARM_A.InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMSmallPage (Inl p);
liftE (do y <- storePTE p ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU p (addrFromPPtr p))
od)
odE)
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (?P41 pd and (\<lambda>s. vptr < kernel_base)) s
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ?Q'37 pd s
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 10. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> corres (?ftr'42 pd \<oplus> ?r'16 pd pd) (?R42 pd p) (?R'42 pd pa) (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p ARM_A.InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSmallPage (Inl pa);
liftE (do y <- storePTE pa ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pa (addrFromPPtr pa))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>?R42 pd\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>?R'42 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> corres (?ftr'42 pd \<oplus> ?r'16 pd pd) (?R42 pd pa) (?R'42 pd pa) (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa));
liftE (do y <- store_pte pa ARM_A.InvalidPTE;
do_machine_op (cleanByVA_PoU pa (addrFromPPtr pa))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSmallPage (Inl pa);
liftE (do y <- storePTE pa ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pa (addrFromPPtr pa))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>?R42 pd\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>?R'42 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>pd p pa y ya. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa; dc y ya\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) (?R49 pd p pa y) (?R'49 pd p pa ya) (liftE (do y <- store_pte pa ARM_A.InvalidPTE;
do_machine_op (cleanByVA_PoU pa (addrFromPPtr pa))
od)) (liftE (do y <- storePTE pa ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pa (addrFromPPtr pa))
od))
 2. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>?R49 pd p pa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>?R'49 pd p pa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> corres (?r'16 pd pd) (?R49 pd pa pa ()) (?R'49 pd pa pa ()) (do y <- store_pte pa ARM_A.InvalidPTE;
do_machine_op (cleanByVA_PoU pa (addrFromPPtr pa))
od) (do y <- storePTE pa ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pa (addrFromPPtr pa))
od)
 2. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>?R49 pd p pa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>?R'49 pd p pa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
A total of 19 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> corres (?r'61 pd p pa) (?P73 pd pa pa ()) (?P'69 pd pa pa ()) (store_pte pa ARM_A.InvalidPTE) (storePTE pa ARM_H.InvalidPTE)
 2. \<And>pd p pa y ya. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa; ?r'61 pd p pa y ya\<rbrakk> \<Longrightarrow> corres (?r'16 pd pd) (?R61 pd p pa y) (?R'61 pd p pa ya) (do_machine_op (cleanByVA_PoU pa (addrFromPPtr pa))) (doMachineOp (cleanByVA_PoU pa (addrFromPPtr pa)))
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q71 pd pa pa ()\<rbrace> store_pte pa ARM_A.InvalidPTE \<lbrace>?R61 pd p pa\<rbrace>
 4. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 pd pa pa ()\<rbrace> storePTE pa ARM_H.InvalidPTE \<lbrace>?R'61 pd p pa\<rbrace>
 5. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>\<lambda>a. ?P73 pd p pa a and ?Q71 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>\<lambda>a. ?P'69 pd p pa a and ?Q'67 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 10. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> pte_relation_aligned (pa >> 2) ARM_A.InvalidPTE ARM_H.InvalidPTE
 2. \<And>pd p pa y ya. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa; dc y ya\<rbrakk> \<Longrightarrow> corres (?r'16 pd pd) (?R61 pd p pa y) (?R'61 pd p pa ya) (do_machine_op (cleanByVA_PoU pa (addrFromPPtr pa))) (doMachineOp (cleanByVA_PoU pa (addrFromPPtr pa)))
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q71 pd pa pa ()\<rbrace> store_pte pa ARM_A.InvalidPTE \<lbrace>?R61 pd p pa\<rbrace>
 4. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 pd pa pa ()\<rbrace> storePTE pa ARM_H.InvalidPTE \<lbrace>?R'61 pd p pa\<rbrace>
 5. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>\<lambda>a. pte_at pa and pspace_aligned and valid_etcbs and ?Q71 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'67 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 10. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd p pa y ya. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa; dc y ya\<rbrakk> \<Longrightarrow> corres (?r'16 pd pd) (?R61 pd p pa y) (?R'61 pd p pa ya) (do_machine_op (cleanByVA_PoU pa (addrFromPPtr pa))) (doMachineOp (cleanByVA_PoU pa (addrFromPPtr pa)))
 2. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q71 pd pa pa ()\<rbrace> store_pte pa ARM_A.InvalidPTE \<lbrace>?R61 pd p pa\<rbrace>
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 pd pa pa ()\<rbrace> storePTE pa ARM_H.InvalidPTE \<lbrace>?R'61 pd p pa\<rbrace>
 4. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>\<lambda>a. pte_at pa and pspace_aligned and valid_etcbs and ?Q71 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'67 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd p pa y ya. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa; dc y ya\<rbrakk> \<Longrightarrow> corres_underlying Id False True (?r'16 pd pd) (\<lambda>_. True) (\<lambda>_. True) (cleanByVA_PoU pa (addrFromPPtr pa)) (cleanByVA_PoU pa (addrFromPPtr pa))
 2. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q71 pd pa pa ()\<rbrace> store_pte pa ARM_A.InvalidPTE \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 pd pa pa ()\<rbrace> storePTE pa ARM_H.InvalidPTE \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>\<lambda>a. pte_at pa and pspace_aligned and valid_etcbs and ?Q71 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'67 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'16 pd pd) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd p pa y ya. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa; dc y ya; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanByVA_PoU pa (addrFromPPtr pa))
 2. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q71 pd pa pa ()\<rbrace> store_pte pa ARM_A.InvalidPTE \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 pd pa pa ()\<rbrace> storePTE pa ARM_H.InvalidPTE \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>\<lambda>a. pte_at pa and pspace_aligned and valid_etcbs and ?Q71 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'67 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q71 pd pa pa ()\<rbrace> store_pte pa ARM_A.InvalidPTE \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 pd pa pa ()\<rbrace> storePTE pa ARM_H.InvalidPTE \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q57 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl pa)) \<lbrace>\<lambda>a. pte_at pa and pspace_aligned and valid_etcbs and ?Q71 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd p pa. \<lbrakk>sz = ARMSmallPage; vptr < kernel_base; p = pa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'55 pd pa\<rbrace> checkMappingPPtr pptr ARMSmallPage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'67 pd p pa a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q42 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>a. (case Inl a of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl a of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSmallPage)) and ?Q57 pd a\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; vptr < kernel_base\<rbrakk> \<Longrightarrow> \<lbrace>?Q'42 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'55 pd a\<rbrace>, -
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSmallPage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q42 pd and (\<lambda>s. vptr < kernel_base)) s
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'42 pd) s
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
A total of 20 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; valid_unmap ARMSmallPage (asid, vptr)\<rbrakk> \<Longrightarrow> pde_at (lookup_pd_slot pd vptr) s \<and> is_aligned pd pd_bits \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> vmsz_aligned vptr ARMSmallPage \<and> is_aligned pd pd_bits
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True \<and> (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)) a))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; valid_unmap ARMSmallPage (asid, vptr)\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> is_aligned vptr 12
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True \<and> (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)) a))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; 0 < asid \<and> is_aligned vptr 12\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True \<and> (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)) a))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>sz = ARMSmallPage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; 0 < asid \<and> is_aligned vptr 12\<rbrakk> \<Longrightarrow> is_aligned pd pd_bits
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True \<and> (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)) a))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSmallPage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True \<and> (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)) a))) s
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 8. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 9. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 10. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 7. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 8. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 9. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) (?Q151 pd) (?Q'151 pd) (doE p <- lookup_pt_slot pd vptr;
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE p <- lookupPTSlot pd vptr;
y <- checkMappingPPtr pptr ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) largePagePTEOffsets)) (last (map (\<lambda>x. x + p) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + p) largePagePTEOffsets))))
od)
odE)
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> ?Q151 pd s
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ?Q'151 pd s
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa\<rbrakk> \<Longrightarrow> corres (?ftr'155 pd \<oplus> (\<lambda>a b. True)) (?R155 pd p) (?R'155 pd pa) (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMLargePage (Inl pa);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) largePagePTEOffsets)) (last (map (\<lambda>x. x + pa) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + pa) largePagePTEOffsets))))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>?R155 pd\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>?R'155 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned p 6\<rbrakk> \<Longrightarrow> corres (?ftr'155 pd \<oplus> (\<lambda>a b. True)) (?P163 pd p) (?R'155 pd pa) (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMLargePage (Inl pa);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) largePagePTEOffsets)) (last (map (\<lambda>x. x + pa) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + pa) largePagePTEOffsets))))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. ?P163 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>?R'155 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> corres (?ftr'155 pd \<oplus> (\<lambda>a b. True)) (?P163 pd pa) (?R'155 pd pa) (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa));
liftE (do y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMLargePage (Inl pa);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) largePagePTEOffsets)) (last (map (\<lambda>x. x + pa) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + pa) largePagePTEOffsets))))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. ?P163 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>?R'155 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; dc y ya\<rbrakk> \<Longrightarrow> corres (?ftr'164 pd p pa \<oplus> (\<lambda>a b. True)) (?R164 pd p pa y) (?R'164 pd p pa ya) (liftE (do y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))
od)) (liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) largePagePTEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) largePagePTEOffsets)) (last (map (\<lambda>x. x + pa) largePagePTEOffsets) + (2 ^ pteBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + pa) largePagePTEOffsets))))
od))
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>?R164 pd p pa\<rbrace>, -
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>?R'164 pd p pa\<rbrace>, -
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R164 pd pa pa ()) (?R'164 pd pa pa ()) (do y <- mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))
od) (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))
od)
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>?R164 pd p pa\<rbrace>, -
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>?R'164 pd p pa\<rbrace>, -
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> corres (?r'175 pd p pa) (?P186 pd pa pa ()) (?P'182 pd pa pa ()) (mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
 2. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; ?r'175 pd p pa y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. ?P186 pd p pa a and ?Q184 pd p pa a\<rbrace>, -
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. ?P'182 pd p pa a and ?Q'180 pd p pa a\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 10. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
A total of 21 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> ?r'175 pd p pa [] []
 2. \<And>pd p pa x xs y ys. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; ?r'175 pd p pa xs ys; ?r'192 pd p pa x y\<rbrakk> \<Longrightarrow> ?r'175 pd p pa (x # xs) (y # ys)
 3. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> ?S192 pd p pa\<rbrakk> \<Longrightarrow> corres (?r'192 pd p pa) (?P186 pd pa pa ()) (?P'182 pd pa pa ()) (swp store_pte ARM_A.InvalidPTE x) (swp storePTE ARM_H.InvalidPTE y)
 4. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> ?S192 pd p pa\<rbrakk> \<Longrightarrow> \<lbrace>?P186 pd pa pa ()\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. ?P186 pd pa pa ()\<rbrace>
 5. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> ?S192 pd p pa\<rbrakk> \<Longrightarrow> \<lbrace>?P'182 pd pa pa ()\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. ?P'182 pd pa pa ()\<rbrace>
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) \<subseteq> ?S192 pd p pa
 8. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; ?r'175 pd p pa y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 10. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) \<subseteq> ?S192 pd p pa
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> ?r'175 pd p pa [] []
 3. \<And>pd p pa x xs y ys. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; ?r'175 pd p pa xs ys; ?r'192 pd p pa x y\<rbrakk> \<Longrightarrow> ?r'175 pd p pa (x # xs) (y # ys)
 4. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> ?S192 pd p pa\<rbrakk> \<Longrightarrow> corres (?r'192 pd p pa) (?P186 pd pa pa ()) (?P'182 pd pa pa ()) (swp store_pte ARM_A.InvalidPTE x) (swp storePTE ARM_H.InvalidPTE y)
 5. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> ?S192 pd p pa\<rbrakk> \<Longrightarrow> \<lbrace>?P186 pd pa pa ()\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. ?P186 pd pa pa ()\<rbrace>
 6. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> ?S192 pd p pa\<rbrakk> \<Longrightarrow> \<lbrace>?P'182 pd pa pa ()\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. ?P'182 pd pa pa ()\<rbrace>
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 8. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; ?r'175 pd p pa y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 10. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> ?r'175 pd p pa [] []
 2. \<And>pd p pa x xs y ys. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; ?r'175 pd p pa xs ys; ?r'192 pd p pa x y\<rbrakk> \<Longrightarrow> ?r'175 pd p pa (x # xs) (y # ys)
 3. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> corres (?r'192 pd p pa) (?P186 pd pa pa ()) (?P'182 pd pa pa ()) (swp store_pte ARM_A.InvalidPTE x) (swp storePTE ARM_H.InvalidPTE y)
 4. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P186 pd pa pa ()\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. ?P186 pd pa pa ()\<rbrace>
 5. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P'182 pd pa pa ()\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. ?P'182 pd pa pa ()\<rbrace>
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 7. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; ?r'175 pd p pa y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 10. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. ?P186 pd p pa a and ?Q184 pd p pa a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>pd p pa x xs y ys. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True; ?r'192 pd p pa x y\<rbrakk> \<Longrightarrow> True
 2. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> corres (?r'192 pd p pa) (?P186 pd pa pa ()) (?P'182 pd pa pa ()) (swp store_pte ARM_A.InvalidPTE x) (swp storePTE ARM_H.InvalidPTE y)
 3. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P186 pd pa pa ()\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. ?P186 pd pa pa ()\<rbrace>
 4. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P'182 pd pa pa ()\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. ?P'182 pd pa pa ()\<rbrace>
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 6. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. ?P186 pd p pa a and ?Q184 pd p pa a\<rbrace>, -
 10. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. ?P'182 pd p pa a and ?Q'180 pd p pa a\<rbrace>, -
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> corres (?r'192 pd p pa) (?P186 pd pa pa ()) (?P'182 pd pa pa ()) (swp store_pte ARM_A.InvalidPTE x) (swp storePTE ARM_H.InvalidPTE y)
 2. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P186 pd pa pa ()\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. ?P186 pd pa pa ()\<rbrace>
 3. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P'182 pd pa pa ()\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. ?P'182 pd pa pa ()\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 5. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. ?P186 pd p pa a and ?Q184 pd p pa a\<rbrace>, -
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. ?P'182 pd p pa a and ?Q'180 pd p pa a\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>pd pa xa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; xa \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> corres (?r'192 pd pa pa) (?P186 pd pa pa ()) (?P'182 pd pa pa ()) (store_pte (xa + pa) ARM_A.InvalidPTE) (storePTE (xa + pa) ARM_H.InvalidPTE)
 2. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P186 pd pa pa ()\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. ?P186 pd pa pa ()\<rbrace>
 3. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>?P'182 pd pa pa ()\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. ?P'182 pd pa pa ()\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 5. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. ?P186 pd p pa a and ?Q184 pd p pa a\<rbrace>, -
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. ?P'182 pd p pa a and ?Q'180 pd p pa a\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>pd pa xa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; xa \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> corres (?r'192 pd pa pa) (?Q208 pd pa xa) (?Q'208 pd pa xa) (store_pte (xa + pa) ARM_A.InvalidPTE) (storePTE (xa + pa) ARM_H.InvalidPTE)
 2. \<And>pd pa xa s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; xa \<in> set [0 , 4 .e. 0x3C]; ((\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q208 pd pa xa s
 3. \<And>pd pa xa s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; xa \<in> set [0 , 4 .e. 0x3C]; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ?Q'208 pd pa xa s
 4. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace>
 5. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct'\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct'\<rbrace>
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 7. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 10. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>pd pa xa s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; xa \<in> set [0 , 4 .e. 0x3C]; ((\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs) s\<rbrakk> \<Longrightarrow> (pte_at (xa + pa) and pspace_aligned and valid_etcbs) s
 2. \<And>pd pa xa s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; xa \<in> set [0 , 4 .e. 0x3C]; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct') s
 3. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace>
 4. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct'\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct'\<rbrace>
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 6. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 10. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>pd pa xa s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; xa \<in> set [0 , 4 .e. 0x3C]; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct') s
 2. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace>
 3. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct'\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct'\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 5. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 9. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace> swp store_pte ARM_A.InvalidPTE x \<lbrace>\<lambda>rv. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs\<rbrace>
 2. \<And>pd p pa x y. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; (x, y) \<in> set (zip (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct'\<rbrace> swp storePTE ARM_H.InvalidPTE y \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct'\<rbrace>
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])
 4. \<And>pd p pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd p pa y) (?R'175 pd p pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 6. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 7. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 8. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
A total of 23 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pd pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R175 pd pa pa y) (?R'175 pd pa pa ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))))
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R175 pd p pa\<rbrace>
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>?R'175 pd p pa\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pd pa y ya. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6\<rbrakk> \<Longrightarrow> corres_underlying Id False True (\<lambda>a b. True) (\<lambda>_. True) (\<lambda>_. True) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6\<rbrakk> \<Longrightarrow> corres_underlying Id False True (\<lambda>a b. True) (\<lambda>_. True) (\<lambda>_. True) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])))) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; is_aligned pa 6; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))))
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 5. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q184 pd pa pa ()\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'180 pd pa pa ()\<rbrace> mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q170 pd pa\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl pa)) \<lbrace>\<lambda>a. (\<lambda>s. \<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + pa) s) and pspace_aligned and valid_etcbs and ?Q184 pd p pa a\<rbrace>, -
 4. \<And>pd p pa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; p = pa; is_aligned pa 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'171 pd pa\<rbrace> checkMappingPPtr pptr ARMLargePage (Inl pa) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'180 pd p pa a\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q155 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>p. (case Inl p of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inl p of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMLargePage)) and ?Q170 pd p and (\<lambda>s. is_aligned p 6)\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and ?Q'171 pd pa\<rbrace>, -
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q155 pd) s
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
A total of 19 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?P'303 pd\<rbrace> lookup_pt_slot pd vptr \<lbrace>\<lambda>rv s. is_aligned rv (pg_entry_align ARMLargePage) \<and> (\<forall>x\<in>set [0 , 4 .e. 0x3C]. pte_at (x + rv) s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> is_aligned rv 6\<rbrace>, -
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'155 pd\<rbrace> lookupPTSlot pd vptr \<lbrace>\<lambda>pa. pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))\<rbrace>, -
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and (\<lambda>s. (pspace_aligned and valid_vspace_objs and valid_arch_state and equal_kernel_mappings and valid_global_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd) s \<and> ?P'303 pd s)) s
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'155 pd) s
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 10. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMLargePage (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and K (is_aligned pd pd_bits \<and> vptr < kernel_base \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and (\<lambda>s. (pspace_aligned and valid_vspace_objs and valid_arch_state and equal_kernel_mappings and valid_global_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd) s \<and> ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and K (vmsz_aligned vptr ARMLargePage) and K (is_aligned pd pd_bits) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs) s \<and> (valid_vspace_objs and valid_arch_state and equal_kernel_mappings and pspace_aligned and valid_global_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and K (is_aligned vptr 16)) s \<and> pspace_aligned s \<and> valid_etcbs s \<and> ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and K (vmsz_aligned vptr ARMLargePage) and K (is_aligned pd pd_bits) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs) s)) s
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 8. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 9. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 10. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask 14)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; 0 < asid; is_aligned vptr 12; is_aligned vptr 16; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask 14 >> 2) \<in> kernel_mapping_slots\<rbrakk> \<Longrightarrow> False
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 8. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 9. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 10. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>sz = ARMLargePage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask 14)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; 0 < asid; is_aligned vptr 12; is_aligned vptr 16; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask 14 >> 2) \<in> kernel_mapping_slots\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>pd s ref refa. \<lbrakk>sz = ARMLargePage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask 14)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; 0 < asid; is_aligned vptr 12; is_aligned vptr 16; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask 14 >> 2) \<in> kernel_mapping_slots; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> False
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)))) s
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>sz = ARMLargePage; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask 14)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; 0 < asid; is_aligned vptr 12; is_aligned vptr 16; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask 14 >> 2) \<in> kernel_mapping_slots; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> False
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 8. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 9. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 10. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMLargePage; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True)))) s
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 7. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 8. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 9. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 6. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 7. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 8. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) (?Q342 pd) (?Q'342 pd) (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
odE)
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ?Q342 pd s
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ?Q'342 pd s
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 8. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 9. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 10. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>pd rv rv'. \<lbrakk>vptr < kernel_base; sz = ARMSection; dc rv rv'\<rbrakk> \<Longrightarrow> corres (?ftr'346 pd \<oplus> (\<lambda>a b. True)) (?R346 pd rv) (?R'346 pd rv') (liftE (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)) (liftE (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>?R346 pd\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>?R'346 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 10. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R346 pd ()) (?R'346 pd ()) (do y <- store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od) (do y <- storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
od)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>?R346 pd\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>?R'346 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 10. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> corres (?r'351 pd) (?P359 pd ()) (?P'357 pd ()) (store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE) (storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE)
 2. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSection; ?r'351 pd y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R351 pd y) (?R'351 pd ya) (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))) (doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr))))
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q358 pd ()\<rbrace> store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE \<lbrace>?R351 pd\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'356 pd ()\<rbrace> storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE \<lbrace>?R'351 pd\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>a. ?P359 pd a and ?Q358 pd a\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'357 pd a and ?Q'356 pd a\<rbrace>, -
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> pde_relation_aligned (lookup_pd_slot pd vptr >> 2) ARM_A.InvalidPDE ARM_H.InvalidPDE
 2. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSection; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R351 pd y) (?R'351 pd ya) (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))) (doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr))))
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q358 pd ()\<rbrace> store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE \<lbrace>?R351 pd\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'356 pd ()\<rbrace> storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE \<lbrace>?R'351 pd\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>a. pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_etcbs and ?Q358 pd a\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'356 pd a\<rbrace>, -
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSection; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R351 pd y) (?R'351 pd ya) (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))) (doMachineOp (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr))))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q358 pd ()\<rbrace> store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE \<lbrace>?R351 pd\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'356 pd ()\<rbrace> storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE \<lbrace>?R'351 pd\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>a. pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_etcbs and ?Q358 pd a\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'356 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSection; dc y ya\<rbrakk> \<Longrightarrow> corres_underlying Id False True (\<lambda>a b. True) (\<lambda>_. True) (\<lambda>_. True) (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr))) (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q358 pd ()\<rbrace> store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'356 pd ()\<rbrace> storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>a. pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_etcbs and ?Q358 pd a\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'356 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSection; dc y ya; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanByVA_PoU (lookup_pd_slot pd vptr) (addrFromPPtr (lookup_pd_slot pd vptr)))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q358 pd ()\<rbrace> store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'356 pd ()\<rbrace> storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>a. pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_etcbs and ?Q358 pd a\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'356 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q358 pd ()\<rbrace> store_pde (lookup_pd_slot pd vptr) ARM_A.InvalidPDE \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'356 pd ()\<rbrace> storePDE (lookup_pd_slot pd vptr) ARM_H.InvalidPDE \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q346 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>a. pde_at (lookup_pd_slot pd vptr) and pspace_aligned and valid_etcbs and ?Q358 pd a\<rbrace>, -
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'346 pd\<rbrace> checkMappingPPtr pptr ARMSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'356 pd a\<rbrace>, -
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSection)) and ?Q346 pd) s
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'346 pd) s
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (\<exists>ref. (ref \<rhd> pd) s) \<and> typ_at (AArch APageDirectory) pd s \<and> vspace_at_asid asid pd s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> valid_etcbs s \<and> valid_unmap ARMSection (asid, vptr)\<rbrakk> \<Longrightarrow> pde_at (lookup_pd_slot pd vptr) s \<and> is_aligned (lookup_pd_slot pd vptr) (pg_entry_align ARMSection) \<and> pde_at (lookup_pd_slot pd vptr) s
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 7. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 8. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 9. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSection; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; valid_unmap ARMSection (asid, vptr)\<rbrakk> \<Longrightarrow> is_aligned (lookup_pd_slot pd vptr) 2
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 7. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 8. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 9. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSection; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; vspace_at_asid asid pd s; (refa \<rhd> (pd + (vptr >> 20 << 2) && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; valid_unmap ARMSection (asid, vptr)\<rbrakk> \<Longrightarrow> is_aligned (pd + (vptr >> 20 << 2)) 2
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 7. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 8. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 9. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSection; (ref \<rhd> pd) s; vspace_at_asid asid pd s; (refa \<rhd> (pd + (vptr >> 20 << 2) && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; valid_unmap ARMSection (asid, vptr)\<rbrakk> \<Longrightarrow> is_aligned (vptr >> 20 << 2) 2
 2. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSection; (ref \<rhd> pd) s; vspace_at_asid asid pd s; (refa \<rhd> (pd + (vptr >> 20 << 2) && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; valid_unmap ARMSection (asid, vptr)\<rbrakk> \<Longrightarrow> 2 \<le> pd_bits
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 8. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 9. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 10. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pd s ref refa. \<lbrakk>vptr < kernel_base; sz = ARMSection; (ref \<rhd> pd) s; vspace_at_asid asid pd s; (refa \<rhd> (pd + (vptr >> 20 << 2) && ~~ mask pd_bits)) s; valid_arch_state s; valid_vspace_objs s; equal_kernel_mappings s; pspace_aligned s; valid_global_objs s; valid_etcbs s; valid_unmap ARMSection (asid, vptr)\<rbrakk> \<Longrightarrow> 2 \<le> pd_bits
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 7. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 8. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 9. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 6. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 7. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 8. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (pspace_aligned' and pspace_distinct') (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (12 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> corres (dc \<oplus> (\<lambda>a b. True)) (?Q415 pd) (?Q'415 pd) (doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)));
liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (doE y <- checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr));
liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
odE)
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ?Q415 pd s
 3. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ?Q'415 pd s
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 7. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 8. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 9. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd rv rv'. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; dc rv rv'\<rbrakk> \<Longrightarrow> corres (?ftr'419 pd \<oplus> (\<lambda>a b. True)) (?R419 pd rv) (?R'419 pd rv') (liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)) (liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>?R419 pd\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>?R'419 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd rv rv'. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; dc rv rv'; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> corres (?ftr'419 pd \<oplus> (\<lambda>a b. True)) (?P425 pd rv) (?R'419 pd rv') (liftE (do y <- assert (lookup_pd_slot pd vptr && mask 6 = 0);
y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od)) (liftE (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. ?P425 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>?R'419 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?P425 pd ()) (?R'419 pd ()) (do y <- mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
od) (do y <- mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))))
od)
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. ?P425 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>?R'419 pd\<rbrace>, -
 4. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 6. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 9. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 10. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> corres (?r'426 pd) (?P434 pd ()) (?P'432 pd ()) (mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))
 2. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; ?r'426 pd y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. ?P434 pd rv and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 8. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> ?S439 pd\<rbrakk> \<Longrightarrow> corres (?r'439 pd) (typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))) (?P'432 pd ()) (swp store_pde ARM_A.InvalidPDE x) (swp storePDE ARM_H.InvalidPDE y)
 2. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> ?S439 pd\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> ?S439 pd\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) \<subseteq> ?S439 pd
 6. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) \<subseteq> ?S439 pd
 2. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> ?S439 pd\<rbrakk> \<Longrightarrow> corres (?r'439 pd) (typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))) (?P'432 pd ()) (swp store_pde ARM_A.InvalidPDE x) (swp storePDE ARM_H.InvalidPDE y)
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> ?S439 pd\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 4. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> ?S439 pd\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 6. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> corres (?r'439 pd) (typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))) (?P'432 pd ()) (swp store_pde ARM_A.InvalidPDE x) (swp storePDE ARM_H.InvalidPDE y)
 2. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 5. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
 10. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pd xa. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> corres (?r'439 pd) (typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) (?P'432 pd ()) (store_pde (xa + lookup_pd_slot pd vptr) ARM_A.InvalidPDE) (storePDE (xa + lookup_pd_slot pd vptr) ARM_H.InvalidPDE)
 2. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 5. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
 10. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
A total of 20 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>pd xa. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> pde_relation_aligned (xa + lookup_pd_slot pd vptr >> 2) ARM_A.InvalidPDE ARM_H.InvalidPDE
 2. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; (typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> (pde_at (xa + lookup_pd_slot pd vptr) and pspace_aligned and valid_etcbs) s
 3. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; ?P'432 pd () s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct') s
 4. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 5. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 7. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; typ_at (AArch APageDirectory) pd s \<and> pspace_aligned s \<and> valid_etcbs s \<and> valid_unmap ARMSuperSection (asid, vptr)\<rbrakk> \<Longrightarrow> pde_at (xa + lookup_pd_slot pd vptr) s
 2. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; ?P'432 pd () s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct') s
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 4. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 6. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; typ_at (AArch APageDirectory) pd s; pspace_aligned s; valid_etcbs s; valid_unmap ARMSuperSection (asid, vptr)\<rbrakk> \<Longrightarrow> pde_at (xa + lookup_pd_slot pd vptr) s
 2. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; ?P'432 pd () s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct') s
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 4. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 6. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; typ_at (AArch APageDirectory) pd s; pspace_aligned s; valid_etcbs s; valid_unmap ARMSuperSection (asid, vptr)\<rbrakk> \<Longrightarrow> is_aligned vptr 24
 2. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; ?P'432 pd () s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct') s
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 4. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 6. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 10. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>pd xa s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; xa \<in> set [0 , 4 .e. 0x3C]; ?P'432 pd () s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct') s
 2. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 3. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>?P'432 pd ()\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. ?P'432 pd ()\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 5. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 9. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. ?P'432 pd a and ?Q'431 pd a\<rbrace>, -
 10. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace> swp store_pde ARM_A.InvalidPDE x \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr))\<rbrace>
 2. \<And>pd x y. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; (x, y) \<in> set (zip (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct'\<rbrace> swp storePDE ARM_H.InvalidPDE y \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct'\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) = length (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)
 4. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; dc y ya\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) + (2 ^ pdeBits - 1)) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets)))))
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 6. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 7. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 8. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'431 pd a\<rbrace>, -
 9. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 10. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
A total of 19 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R426 pd y) (?R'426 pd ya) (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))) (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])))))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>?R426 pd\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>?R'426 pd\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'431 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd y ya. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> corres_underlying Id False True (\<lambda>a b. True) (\<lambda>_. True) (\<lambda>_. True) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])))) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'431 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> corres_underlying Id False True (\<lambda>a b. True) (\<lambda>_. True) (\<lambda>_. True) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])))) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'431 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]))))
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>\<lambda>ya _. True\<rbrace>
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 5. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'431 pd a\<rbrace>, -
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 7. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q433 pd ()\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; is_aligned (lookup_pd_slot pd vptr) 6\<rbrakk> \<Longrightarrow> \<lbrace>?Q'431 pd ()\<rbrace> mapM (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd vptr) superSectionPDEOffsets) \<lbrace>\<lambda>ya _. True\<rbrace>
 3. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q419 pd\<rbrace> throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr))) \<lbrace>\<lambda>rv. typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and ?Q433 pd rv and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)\<rbrace>, -
 4. \<And>pd. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'419 pd\<rbrace> checkMappingPPtr pptr ARMSuperSection (Inr (lookup_pd_slot pd vptr)) \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and ?Q'431 pd a\<rbrace>, -
 5. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and ?Q419 pd) s
 6. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'419 pd) s
 7. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 10. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
A total of 15 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; ((\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and (\<lambda>y. valid_unmap ARMSuperSection (asid, vptr))) s\<rbrakk> \<Longrightarrow> ((case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> pte_at ptr | Inr ptr \<Rightarrow> pde_at ptr) and (\<lambda>s. case Inr (lookup_pd_slot pd vptr) of Inl ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection) | Inr ptr \<Rightarrow> is_aligned ptr (pg_entry_align ARMSuperSection)) and (\<lambda>s. (typ_at (AArch APageDirectory) pd and pspace_aligned and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>a. True) and (\<lambda>s. is_aligned (lookup_pd_slot pd vptr) 6)) s \<and> True)) s
 2. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 6. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 7. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 8. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>pd s. \<lbrakk>vptr < kernel_base; sz = ARMSuperSection; (pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (pspace_aligned' and pspace_distinct' and (\<lambda>a. True))) s
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q18 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>a. K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) and cur_tcb and valid_arch_state and valid_objs and vspace_at_asid asid pda and valid_asid_map and valid_vspace_objs and valid_vs_lookup and valid_global_objs and unique_table_refs \<circ> caps_of_state and pspace_aligned and pspace_distinct\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and ?Q18 pd\<rbrace>, -
 4. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 5. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 6. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 9. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?P'559 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>rv s. cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> vspace_at_asid asid pda s \<and> valid_asid_map s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> (unique_table_refs \<circ> caps_of_state) s \<and> pspace_aligned s \<and> pspace_distinct s\<rbrace>, -
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and (\<lambda>s. True \<and> K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) s \<and> ?P'559 pd s)\<rbrace>, -
 4. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 5. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 6. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 9. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (10 subgoals):
 1. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?P'559 pd\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE \<lbrace>\<lambda>_. invs and vspace_at_asid asid pda\<rbrace>, -
 2. \<And>pd pda rv s. \<lbrakk>pd = pda; (invs and vspace_at_asid asid pda) s\<rbrakk> \<Longrightarrow> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> vspace_at_asid asid pda s \<and> valid_asid_map s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> (unique_table_refs \<circ> caps_of_state) s \<and> pspace_aligned s \<and> pspace_distinct s
 3. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and (\<lambda>s. True \<and> K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) s \<and> ?P'559 pd s)\<rbrace>, -
 5. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 6. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 7. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 10. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>pd pda s. \<lbrakk>pd = pda; invs s \<and> vspace_at_asid asid pda s\<rbrakk> \<Longrightarrow> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> pspace_distinct s
 2. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and (\<lambda>s. True \<and> K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) s \<and> (sz = ARMSmallPage \<longrightarrow> True \<and> True \<and> invs s \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and K (is_aligned pd pd_bits) and K (vptr < kernel_base)) s \<and> vspace_at_asid asid pd s) \<and> (sz = ARMLargePage \<longrightarrow> True \<and> True \<and> invs s \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and K (is_aligned pd pd_bits) and K (vptr < kernel_base) and K (is_aligned vptr 16)) s \<and> vspace_at_asid asid pd s) \<and> (sz = ARMSection \<longrightarrow> True \<and> True \<and> invs s \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> lookup_pd_slot pd vptr && ~~ mask pd_bits \<notin> global_refs s \<and> vspace_at_asid asid pd s) \<and> (sz = ARMSuperSection \<longrightarrow> True \<and> True \<and> invs s \<and> (\<forall>sl\<in>set [0 , 4 .e. 0x3C]. UCAST(32 \<rightarrow> 12) (sl + lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set [0 , 4 .e. 0x3C]. sl + lookup_pd_slot pd vptr && ~~ mask pd_bits \<notin> global_refs s) \<and> vspace_at_asid asid pd s))\<rbrace>, -
 4. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 5. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 6. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 9. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>pd pda. pd = pda \<Longrightarrow> \<lbrace>?Q'20 pda\<rbrace> case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pda vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pda vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<lbrace>?Q9\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>pd. (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and typ_at (AArch APageDirectory) pd and vspace_at_asid asid pd and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits)) s) and valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and valid_etcbs and K (valid_unmap sz (asid, vptr)) and (\<lambda>s. vptr < kernel_base) and (\<lambda>s. True \<and> K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) s \<and> (sz = ARMSmallPage \<longrightarrow> True \<and> True \<and> invs s \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and K (is_aligned pd pd_bits) and K (vptr < kernel_base)) s \<and> vspace_at_asid asid pd s) \<and> (sz = ARMLargePage \<longrightarrow> True \<and> True \<and> invs s \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and K (is_aligned pd pd_bits) and K (vptr < kernel_base) and K (is_aligned vptr 16)) s \<and> vspace_at_asid asid pd s) \<and> (sz = ARMSection \<longrightarrow> True \<and> True \<and> invs s \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> lookup_pd_slot pd vptr && ~~ mask pd_bits \<notin> global_refs s \<and> vspace_at_asid asid pd s) \<and> (sz = ARMSuperSection \<longrightarrow> True \<and> True \<and> invs s \<and> (\<forall>sl\<in>set [0 , 4 .e. 0x3C]. UCAST(32 \<rightarrow> 12) (sl + lookup_pd_slot pd vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set [0 , 4 .e. 0x3C]. sl + lookup_pd_slot pd vptr && ~~ mask pd_bits \<notin> global_refs s) \<and> vspace_at_asid asid pd s))\<rbrace>, -
 3. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and ?Q'20 pda\<rbrace>, -
 4. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 5. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and ?Q9 and ?Q4) s
 8. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<lbrace>?P'1223\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>rv s. (sz = ARMSmallPage \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> rv) s) \<and> is_aligned rv pd_bits \<and> vptr < kernel_base \<and> vspace_at_asid asid rv s) \<and> (sz = ARMLargePage \<longrightarrow> invs s \<and> (\<exists>ref. (ref \<rhd> rv) s) \<and> is_aligned rv pd_bits \<and> vptr < kernel_base \<and> is_aligned vptr 16 \<and> vspace_at_asid asid rv s) \<and> (sz = ARMSection \<longrightarrow> invs s \<and> UCAST(32 \<rightarrow> 12) (lookup_pd_slot rv vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> lookup_pd_slot rv vptr && ~~ mask pd_bits \<notin> global_refs s \<and> vspace_at_asid asid rv s) \<and> (sz = ARMSuperSection \<longrightarrow> invs s \<and> (\<forall>sl\<in>set [0 , 4 .e. 0x3C]. UCAST(32 \<rightarrow> 12) (sl + lookup_pd_slot rv vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> (\<forall>sl\<in>set [0 , 4 .e. 0x3C]. sl + lookup_pd_slot rv vptr && ~~ mask pd_bits \<notin> global_refs s) \<and> vspace_at_asid asid rv s)\<rbrace>, -
 2. \<lbrace>?Q'9\<rbrace> findPDForASID asid \<lbrace>\<lambda>pda. pspace_aligned' and pspace_distinct' and (\<lambda>s. True \<and> (sz = ARMSmallPage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMLargePage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSuperSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s))\<rbrace>, -
 3. \<And>y ya. dc y ya \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (return ()) (return ())
 4. \<lbrace>?Q4\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do store_pte p ARM_A.InvalidPTE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookup_pt_slot pd vptr;
throw_on_false undefined $ check_mapping_pptr pptr sz (Inl p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pte ARM_A.InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do store_pde p ARM_A.InvalidPDE;
do_machine_op $ cleanByVA_PoU p (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookup_pd_slot pd vptr);
throw_on_false undefined $ check_mapping_pptr pptr sz (Inr p);
liftE $ do assert $ p && mask 6 = 0;
slots <- return (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
mapM (swp store_pde ARM_A.InvalidPDE) slots;
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots))
od
odE;
liftE (flush_page sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrace>?Q'4\<rbrace> doE pd <- findPDForASID asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots))
od
odE | ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. (invs and valid_etcbs and (\<lambda>y. valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits)) s \<Longrightarrow> ((\<lambda>s. valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) and valid_vspace_objs and pspace_aligned and K (0 < asid \<and> asid \<le> mask asidBits) and (\<lambda>s. True \<and> valid_vspace_objs s \<and> True \<and> (pspace_aligned and valid_vspace_objs) s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> valid_etcbs s \<and> K (valid_unmap sz (asid, vptr)) s \<and> vptr < kernel_base \<and> True \<and> K (is_aligned vptr pageBits \<and> asid \<le> mask local.asid_bits \<and> asid \<noteq> 0) s \<and> ?P'1223 s) and ?Q4) s
 7. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'9 and ?Q'4) s proof (prove)
goal (2 subgoals):
 1. \<And>s. invs s \<and> valid_etcbs s \<and> valid_unmap sz (asid, vptr) \<and> vptr < kernel_base \<and> asid \<le> mask local.asid_bits \<Longrightarrow> (valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> 0 < asid \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> is_aligned vptr pageBits \<and> asid \<noteq> 0 \<and> (sz = ARMSmallPage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMLargePage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> is_aligned vptr 16) \<and> (sz = ARMSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSection \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSuperSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> is_aligned vptr 24 \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection))
 2. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (pspace_aligned' and pspace_distinct' and (\<lambda>s. True \<and> (sz = ARMSmallPage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMLargePage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSuperSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s))) and (\<lambda>s. True \<and> True)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs s; valid_etcbs s; 0 < asid; is_aligned vptr pageBits; sz = ARMSuperSection \<longrightarrow> is_aligned vptr 24; sz = ARMLargePage \<longrightarrow> is_aligned vptr 16; sz = ARMSection \<longrightarrow> is_aligned vptr 20; vptr < kernel_base; asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> (valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> asid \<noteq> 0 \<and> (sz = ARMSmallPage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMLargePage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSection \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSuperSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection))
 2. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (pspace_aligned' and pspace_distinct' and (\<lambda>s. True \<and> (sz = ARMSmallPage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMLargePage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSuperSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s))) and (\<lambda>s. True \<and> True)) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>invs s; valid_etcbs s; 0 < asid; is_aligned vptr pageBits; sz = ARMSuperSection \<longrightarrow> is_aligned vptr 24; sz = ARMLargePage \<longrightarrow> is_aligned vptr 16; sz = ARMSection \<longrightarrow> is_aligned vptr 20; vptr < kernel_base; asid \<le> mask local.asid_bits; sz = ARMSmallPage\<rbrakk> \<Longrightarrow> (valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> asid \<noteq> 0 \<and> (sz = ARMSmallPage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMLargePage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSection \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSuperSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection))
 2. \<And>s. \<lbrakk>invs s; valid_etcbs s; 0 < asid; is_aligned vptr pageBits; sz = ARMSuperSection \<longrightarrow> is_aligned vptr 24; sz = ARMLargePage \<longrightarrow> is_aligned vptr 16; sz = ARMSection \<longrightarrow> is_aligned vptr 20; vptr < kernel_base; asid \<le> mask local.asid_bits; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> asid \<noteq> 0 \<and> (sz = ARMSmallPage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMLargePage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSection \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSuperSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection))
 3. \<And>s. \<lbrakk>invs s; valid_etcbs s; 0 < asid; is_aligned vptr pageBits; sz = ARMSuperSection \<longrightarrow> is_aligned vptr 24; sz = ARMLargePage \<longrightarrow> is_aligned vptr 16; sz = ARMSection \<longrightarrow> is_aligned vptr 20; vptr < kernel_base; asid \<le> mask local.asid_bits; sz = ARMSection\<rbrakk> \<Longrightarrow> (valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> asid \<noteq> 0 \<and> (sz = ARMSmallPage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMLargePage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSection \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSuperSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection))
 4. \<And>s. \<lbrakk>invs s; valid_etcbs s; 0 < asid; is_aligned vptr pageBits; sz = ARMSuperSection \<longrightarrow> is_aligned vptr 24; sz = ARMLargePage \<longrightarrow> is_aligned vptr 16; sz = ARMSection \<longrightarrow> is_aligned vptr 20; vptr < kernel_base; asid \<le> mask local.asid_bits; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (valid_arch_state s \<or> vspace_at_asid asid ?pd14 s) \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> asid \<noteq> 0 \<and> (sz = ARMSmallPage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMLargePage \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSection \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s) \<and> (sz = ARMSuperSection \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection \<and> ((\<exists>x. x \<in> set [0 , 4 .e. 0x3C]) \<longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_global_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> vmsz_aligned vptr ARMSuperSection))
 5. \<And>s. (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb') s \<Longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (pspace_aligned' and pspace_distinct' and (\<lambda>s. True \<and> (sz = ARMSmallPage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMLargePage \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s) \<and> (sz = ARMSuperSection \<longrightarrow> True \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_arch_state' s \<and> cur_tcb' s))) and (\<lambda>s. True \<and> True)) s proof (prove)
goal:
No subgoals!