theory VSpace_R

lemma performPageInvocation_corres:
  assumes "page_invocation_map pgi pgi'"
  shows "corres (=) (invs and valid_etcbs and valid_page_inv pgi)
            (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)))
            (perform_page_invocation pgi) (performPageInvocation pgi')" proof - have pull_out_P:
    "\<And>P s Q c p. P s \<and> (\<forall>c. caps_of_state s p = Some c \<longrightarrow> Q s c) \<longrightarrow>
       (\<forall>c. caps_of_state s p = Some c \<longrightarrow> P s \<and> Q s c)" by blast show ?thesis using assms apply (cases pgi) apply (rename_tac word cap prod sum)
     \<comment> \<open>PageMap\<close> apply (clarsimp simp: perform_page_invocation_def performPageInvocation_def
                           page_invocation_map_def) apply (rule corres_guard_imp) apply (rule_tac R="\<lambda>_. invs and (valid_page_map_inv word cap (a,b) sum)
                              and valid_etcbs and (\<lambda>s. caps_of_state s (a,b) = Some cap)"
         and R'="\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m'
         and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))" in corres_split) apply (erule updateCap_same_master) apply (case_tac sum, case_tac aa) apply (clarsimp simp: mapping_map_def valid_slots'_def valid_slots_def valid_page_inv_def
                                neq_Nil_conv valid_page_map_inv_def) apply (rule corres_name_pre) apply (clarsimp simp: mapM_Cons bind_assoc split del: if_split) apply (rule corres_guard_imp) apply (rule corres_split[OF pteCheckIfMapped_corres]) apply (rule corres_split) apply (rule storePTE_corres') apply (clarsimp simp: pte_relation_aligned_def
                                dest!: valid_slots_duplicated_pteD') apply (rule corres_split[where r' = dc]) apply (rule corres_store_pte_with_invalid_tail) apply (clarsimp dest!: valid_slots_duplicated_pteD') apply (rule corres_split[where r'=dc]) apply (rule corres_machine_op[OF corres_Id]) apply (simp add: last_byte_pte_def objBits_simps archObjSize_def pteBits_def) apply simp apply (rule no_fail_cleanCacheRange_PoU) apply (rule corres_split[where r'=dc, OF _ corres_return_eq_same[OF refl]]) apply (clarsimp simp add: when_def) apply (rule invalidate_tlb_by_asid_corres_ex) apply (wp hoare_vcg_ex_lift)+ apply (rule_tac Q="\<lambda>_. K (word \<le> mask asid_bits \<and> word \<noteq> 0) and invs
                                    and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)"
                         in hoare_strengthen_post) prefer 2 apply (auto simp: invs_vspace_objs[simplified])[1] apply (wp mapM_swp_store_pte_invs[where pte="ARM_A.pte.InvalidPTE", simplified]
                           hoare_vcg_ex_lift) apply (wp mapM_UNIV_wp | simp add: swp_def del: fun_upd_apply)+ apply (clarsimp simp del: fun_upd_apply simp add: cte_wp_at_caps_of_state) apply (wp hoare_vcg_const_Ball_lift store_pte_typ_at store_pte_cte_wp_at
                         hoare_vcg_ex_lift)+ apply (wpsimp simp: pteCheckIfMapped_def) apply (clarsimp simp add: cte_wp_at_caps_of_state valid_slots_def parent_for_refs_def
                                     empty_refs_def invs_psp_aligned
                           simp del: fun_upd_apply) apply (rule conjI) apply (rule_tac x=aa in exI, rule_tac x=ba in exI) apply (clarsimp simp: is_pt_cap_def cap_asid_def image_def neq_Nil_conv Collect_disj_eq
                           split: Structures_A.cap.splits arch_cap.splits option.splits) apply (rule conjI) apply clarsimp apply (drule same_refs_lD) apply (rule_tac x=a in exI, rule_tac x=b in exI) apply clarify apply (drule_tac x=refa in spec) apply clarsimp apply (rule conjI[rotated], fastforce) apply auto[1] apply clarsimp apply (case_tac ba) apply (clarsimp simp: mapping_map_def valid_slots_def valid_slots'_def neq_Nil_conv
                               valid_page_inv_def valid_page_map_inv_def) apply (rule corres_name_pre) apply (clarsimp simp: mapM_Cons bind_assoc split del:if_split) apply (rule corres_guard_imp) apply (rule corres_split[OF pdeCheckIfMapped_corres]) apply (rule corres_split) apply (rule storePDE_corres') apply (clarsimp simp: pde_relation_aligned_def
                               dest!: valid_slots_duplicated_pdeD') apply (rule corres_split[where r'=dc]) apply (rule corres_store_pde_with_invalid_tail) apply (clarsimp dest!: valid_slots_duplicated_pdeD') apply (rule corres_split[where r'=dc]) apply (rule corres_machine_op[OF corres_Id]) apply (simp add: last_byte_pde_def objBits_simps archObjSize_def pdeBits_def) apply simp apply (rule no_fail_cleanCacheRange_PoU) apply (rule corres_split[where r'=dc, OF _ corres_return_eq_same[OF refl]]) apply (clarsimp simp: when_def) apply (rule invalidate_tlb_by_asid_corres_ex) apply (wp hoare_vcg_ex_lift)+ apply (rule_tac Q="\<lambda>_. K (word \<le> mask asid_bits \<and> word \<noteq> 0) and invs
                                   and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)" in hoare_strengthen_post) prefer 2 apply (auto simp: invs_vspace_objs[simplified])[1] apply (wp mapM_swp_store_pde_invs_unmap[where pde="ARM_A.pde.InvalidPDE", simplified]
                          hoare_vcg_ex_lift) apply (wp mapM_UNIV_wp store_pde_pd_at_asid | clarsimp simp add: swp_def)+ apply (clarsimp simp add: cte_wp_at_caps_of_state  simp del: fun_upd_apply) apply (wp hoare_vcg_const_Ball_lift store_pde_typ_at hoare_vcg_ex_lift
                        store_pde_pd_at_asid) apply (rule hoare_vcg_conj_lift) apply (rule_tac slots="y # ys" in store_pde_invs_unmap') apply (wp hoare_vcg_const_Ball_lift store_pde_pd_at_asid hoare_vcg_ex_lift) apply (wp | simp add: pdeCheckIfMapped_def)+ apply (clarsimp simp add: cte_wp_at_caps_of_state valid_slots_def parent_for_refs_def
                                    empty_refs_def invs_psp_aligned
                          simp del: fun_upd_apply) apply (rule conjI, rule_tac x=ref in exI, clarsimp) apply (rule conjI) apply (rule_tac x=aa in exI, rule_tac x=ba in exI) apply auto[1] apply (rule conjI) apply (rule_tac x=a in exI, rule_tac x=b in exI, auto simp: same_refs_def)[1] apply (rule conjI) apply (clarsimp simp: pde_at_def obj_at_def
                                       caps_of_state_cteD'[where P=\<top>, simplified]) apply (drule_tac cap=capa and ptr="(aa,ba)"
                         in valid_global_refsD[OF invs_valid_global_refs]) apply assumption+ apply (clarsimp simp: cap_range_def) apply (rule conjI) apply (clarsimp simp: pde_at_def obj_at_def a_type_def) apply (clarsimp split: Structures_A.kernel_object.split_asm if_split_asm
                                  ARM_A.arch_kernel_obj.splits) apply (rule conjI[rotated], fastforce) apply (erule ballEI) apply (clarsimp simp: pde_at_def obj_at_def
                                      caps_of_state_cteD'[where P=\<top>, simplified]) apply (drule_tac cap=capa and ptr="(aa,ba)"
                         in valid_global_refsD[OF invs_valid_global_refs]) apply assumption+ apply (drule_tac x=x in imageI[where f="\<lambda>x. x && ~~ mask pd_bits"]) apply (drule (1) subsetD) apply (clarsimp simp: cap_range_def) apply clarsimp apply (wp arch_update_cap_invs_map set_cap_valid_page_map_inv) apply (wp arch_update_updateCap_invs) apply (clarsimp simp: invs_valid_objs invs_psp_aligned invs_distinct valid_page_inv_def
                            cte_wp_at_caps_of_state is_arch_update_def is_cap_simps) apply (erule (3) subst[OF same_refs_vs_cap_ref_eq, rotated 2]) apply (clarsimp simp: invs_pspace_aligned' invs_pspace_distinct' valid_page_inv'_def cte_wp_at'_def)
    \<comment> \<open>PageUnmap\<close> apply (clarsimp simp: performPageInvocation_def perform_page_invocation_def
                          page_invocation_map_def) apply (rule corres_assume_pre) apply (clarsimp simp: valid_page_inv_def valid_page_inv'_def isCap_simps is_page_cap_def
                    cong: option.case_cong prod.case_cong) apply (case_tac m) apply simp apply (rule corres_guard_imp) apply (rule corres_split[where r'="acap_relation"]) apply simp apply (rule corres_rel_imp) apply (rule get_cap_corres_all_rights_P[where P=is_arch_cap], rule refl) apply (clarsimp simp: is_cap_simps) apply (rule corres_split[where r'=dc, OF _ corres_return_eq_same[OF refl]]) apply (rule_tac F="is_page_cap cap" in corres_gen_asm) apply (rule updateCap_same_master) apply (clarsimp simp: is_page_cap_def update_map_data_def) apply (wp get_cap_wp getSlotCap_wp)+ apply (clarsimp simp: cte_wp_at_caps_of_state) apply (clarsimp simp: cap_rights_update_def acap_rights_update_def update_map_data_def is_cap_simps) apply auto[1] apply (auto simp: cte_wp_at_ctes_of)[1] apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split) apply (rule unmapPage_corres) apply (rule corres_split[where r'=acap_relation]) apply simp apply (rule corres_rel_imp) apply (rule get_cap_corres_all_rights_P[where P=is_arch_cap], rule refl) apply (clarsimp simp: is_cap_simps) apply (rule corres_split[where r'=dc, OF _ corres_return_eq_same[OF refl]]) apply (rule_tac F="is_page_cap cap" in corres_gen_asm) apply (rule updateCap_same_master) apply (clarsimp simp: is_page_cap_def update_map_data_def) apply (wp get_cap_wp getSlotCap_wp)+ apply (simp add: cte_wp_at_caps_of_state) apply (strengthen pull_out_P)+ apply wp apply (simp add: cte_wp_at_ctes_of) apply wp apply (clarsimp simp: valid_unmap_def cte_wp_at_caps_of_state) apply (clarsimp simp: is_cap_simps split: cap.splits arch_cap.splits) apply (clarsimp simp: cap_rights_update_def is_page_cap_def cap_master_cap_simps
                           update_map_data_def acap_rights_update_def) apply (clarsimp simp add: valid_cap_def mask_def) apply auto[1] apply (auto simp: cte_wp_at_ctes_of)[1]
   \<comment> \<open>PageFlush\<close> apply (clarsimp simp: performPageInvocation_def perform_page_invocation_def
                         page_invocation_map_def) apply (rule corres_guard_imp) apply (rule corres_split[where r'=dc, OF _ corres_return_eq_same[OF refl]]) apply (rule corres_when, simp) apply (rule corres_split[OF setVMRootForFlush_corres]) apply (rule corres_split[OF corres_machine_op]) apply (rule doFlush_corres) apply (rule corres_when, simp) apply (rule corres_split[OF getCurThread_corres]) apply simp apply (rule setVMRoot_corres) apply wp+ apply (simp add: cur_tcb_def [symmetric] cur_tcb'_def [symmetric]) apply (wp hoare_drop_imps) apply (simp add: cur_tcb_def [symmetric] cur_tcb'_def [symmetric]) apply (wp hoare_drop_imps)+ apply (auto simp: valid_page_inv_def invs_vspace_objs[simplified])[2]
  \<comment> \<open>PageGetAddr\<close> apply (clarsimp simp: perform_page_invocation_def performPageInvocation_def page_invocation_map_def fromPAddr_def) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (state)
goal (1 subgoal):
 1. corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (1 subgoal):
 1. \<And>P s Q c p. P s \<and> (\<forall>c. caps_of_state s p = Some c \<longrightarrow> Q s c) \<longrightarrow> (\<forall>c. caps_of_state s p = Some c \<longrightarrow> P s \<and> Q s c) proof (state)
this:
?P ?s \<and> (\<forall>c. caps_of_state ?s ?p = Some c \<longrightarrow> ?Q ?s c) \<longrightarrow> (\<forall>c. caps_of_state ?s ?p = Some c \<longrightarrow> ?P ?s \<and> ?Q ?s c)

goal (1 subgoal):
 1. corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (1 subgoal):
 1. corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
using this:
page_invocation_map pgi pgi'

goal (1 subgoal):
 1. corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>x11 x12 x13 x14. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageMap x11 x12 x13 x14\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 2. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>word cap prod sum. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageMap word cap prod sum\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 2. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- updateCap (cte_map (a, b)) c';
y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> corres (=) (?Q10 word cap a b sum c' m') (?Q'10 word cap a b sum c' m') (do y <- set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- updateCap (cte_map (a, b)) c';
y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 2. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> ?Q10 word cap a b sum c' m' s
 3. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?Q'10 word cap a b sum c' m' s
 4. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> corres (?r'14 word cap a b sum c' m') (?P14 word cap a b sum c' m') (?P'14 word cap a b sum c' m') (set_cap cap (a, b)) (updateCap (cte_map (a, b)) c')
 2. \<And>word cap a b sum c' m' rv rv'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; ?r'14 word cap a b sum c' m' rv rv'\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (?P14 word cap a b sum c' m' and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (?P'14 word cap a b sum c' m' and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b sum c' m' rv rv'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 6. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b sum c' m' rv rv' aa ab ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inl aa; aa = (ab, ba)\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 2. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' ab baa ac. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, baa)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, baa)); cap_relation cap c'; pte_relation' ab ac\<rbrakk> \<Longrightarrow> corres (=) (invs and ((\<lambda>s. caps_of_state s (a, b) = Some cap) and same_refs (Inl (ab, baa)) cap and (\<lambda>s. (\<exists>y ys. baa = y # ys) \<and> (\<forall>p\<in>set baa. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s) \<and> wellformed_pte ab \<and> valid_pte ab s) and valid_cap cap and (\<lambda>y. is_pg_cap cap \<and> empty_refs (Inl (ab, baa)) \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0) and (\<lambda>s. \<exists>a b. cte_wp_at (parent_for_refs (Inl (ab, baa))) (a, b) s) and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_pte' ac and pspace_aligned' and valid_slots_duplicated' (Inl (ac, baa)) and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- do flush <- pte_check_if_mapped (hd baa);
y <- store_pte (hd baa) ab;
y <- mapM (swp store_pte ARM_A.InvalidPTE) (tl baa);
y <- do_machine_op (cleanCacheRange_PoU (hd baa) (last_byte_pte (last baa)) (addrFromPPtr (hd baa)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- do tlbFlush <- pteCheckIfMapped (hd baa);
y <- mapM (swp storePTE ac) baa;
y <- doMachineOp (cleanCacheRange_PoU (hd baa) (last baa + (2 ^ pteBits - 1)) (addrFromPPtr (hd baa)));
when tlbFlush (invalidateTLBByASID word)
od;
return []
od)
 2. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' ab baa ac s s'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, baa)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, baa)); cap_relation cap c'; pte_relation' ab ac; (invs and ((\<lambda>s. caps_of_state s (a, b) = Some cap) and same_refs (Inl (ab, baa)) cap and (\<lambda>s. (\<exists>y ys. baa = y # ys) \<and> (\<forall>p\<in>set baa. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s) \<and> wellformed_pte ab \<and> valid_pte ab s) and valid_cap cap and (\<lambda>y. is_pg_cap cap \<and> empty_refs (Inl (ab, baa)) \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0) and (\<lambda>s. \<exists>a b. cte_wp_at (parent_for_refs (Inl (ab, baa))) (a, b) s) and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) s; (invs' and valid_pte' ac and pspace_aligned' and valid_slots_duplicated' (Inl (ac, baa)) and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> corres (=) ((=) s) ((=) s') (do y <- do flush <- pte_check_if_mapped (hd baa);
y <- store_pte (hd baa) ab;
y <- mapM (swp store_pte ARM_A.InvalidPTE) (tl baa);
y <- do_machine_op (cleanCacheRange_PoU (hd baa) (last_byte_pte (last baa)) (addrFromPPtr (hd baa)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- do tlbFlush <- pteCheckIfMapped (hd baa);
y <- mapM (swp storePTE ac) baa;
y <- doMachineOp (cleanCacheRange_PoU (hd baa) (last baa + (2 ^ pteBits - 1)) (addrFromPPtr (hd baa)));
when tlbFlush (invalidateTLBByASID word)
od;
return []
od)
 2. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> corres (=) ((=) s) ((=) s') (do x <- pte_check_if_mapped y;
xa <- store_pte y ab;
xa <- mapM (swp store_pte ARM_A.InvalidPTE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- pteCheckIfMapped y;
xa <- storePTE y ac;
ysa <- mapM (swp storePTE ac) ys;
xa <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when x (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> corres (=) (?Q62 word cap a b c' ab ac s s' y ys aa ba pd ref) (?Q'62 word cap a b c' ab ac s s' y ys aa ba pd ref) (do x <- pte_check_if_mapped y;
xa <- store_pte y ab;
xa <- mapM (swp store_pte ARM_A.InvalidPTE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- pteCheckIfMapped y;
xa <- storePTE y ac;
ysa <- mapM (swp storePTE ac) ys;
xa <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when x (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> ?Q62 word cap a b c' ab ac s s' y ys aa ba pd ref sa
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ?Q'62 word cap a b c' ab ac s s' y ys aa ba pd ref sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> corres (=) (?R66 word cap a b c' ab ac s s' y ys aa ba pd ref x) (?R'66 word cap a b c' ab ac s s' y ys aa ba pd ref xa) (do xa <- store_pte y ab;
xa <- mapM (swp store_pte ARM_A.InvalidPTE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- storePTE y ac;
ysa <- mapM (swp storePTE ac) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>?R66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>?R'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> corres (?r'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa) (?P72 word cap a b c' ab ac s s' y ys aa ba pd ref x) (?P'74 word cap a b c' ab ac s s' y ys aa ba pd ref xa) (store_pte y ab) (storePTE y ac)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; ?r'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc\<rbrakk> \<Longrightarrow> corres (=) (?R71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb) (?R'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc) (do xa <- mapM (swp store_pte ARM_A.InvalidPTE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do ysa <- mapM (swp storePTE ac) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>?R71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>?R'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. ?P72 word cap a b c' ab ac s s' y ys aa ba pd ref x and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. ?P'74 word cap a b c' ab ac s s' y ys aa ba pd ref xa and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> pte_relation_aligned (y >> 2) ab ac
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> corres (=) (?R71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb) (?R'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc) (do xa <- mapM (swp store_pte ARM_A.InvalidPTE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do ysa <- mapM (swp storePTE ac) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>?R71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>?R'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> corres (=) (?R71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb) (?R'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc) (do xa <- mapM (swp store_pte ARM_A.InvalidPTE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do ysa <- mapM (swp storePTE ac) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>?R71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>?R'71 word cap a b c' ab ac s s' y ys aa ba pd ref x xa\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> corres dc (?P94 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb) (?P'96 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc) (mapM (swp store_pte ARM_A.InvalidPTE) ys) (mapM (swp storePTE ac) ys)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres (=) (?R93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd) (?R'93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa) (do xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>?R93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>?R'93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. ?P94 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. ?P'96 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<forall>slot\<in>set ys. \<not> is_aligned (slot >> 2) (pte_align' ac)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres (=) (?R93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd) (?R'93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa) (do xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>?R93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>?R'93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres (=) (?R93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd) (?R'93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa) (do xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>?R93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>?R'93 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
A total of 17 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres dc (?P113 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd) (?P'115 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa) (do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y))) (doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)))
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. ?P113 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. ?P'115 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
A total of 20 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y) = cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa rv. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> dc rv rv
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y))
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa rv. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> dc rv rv
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y))
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y))
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>?R'112 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
A total of 19 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres dc (?P133 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?P'135 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (if x then invalidate_tlb_by_asid word else return ()) (when xa (invalidateTLBByASID word))
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q134 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace> if x then invalidate_tlb_by_asid word else return () \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'136 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace> when xa (invalidateTLBByASID word) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>\<lambda>xe. ?P133 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe and ?Q134 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>\<lambda>xf. ?P'135 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf and ?Q'136 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref xa xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; xa\<rbrakk> \<Longrightarrow> corres dc (?P133 word cap a b c' ab ac s s' y ys aa ba pd ref True True () () xd ysa ()) (?P'135 word cap a b c' ab ac s s' y ys aa ba pd ref True True () () xd ysa ()) (invalidate_tlb_by_asid word) (invalidateTLBByASID word)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q134 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace> if x then invalidate_tlb_by_asid word else return () \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'136 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace> when xa (invalidateTLBByASID word) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>\<lambda>xe. ?P133 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe and ?Q134 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>\<lambda>xf. ?P'135 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf and ?Q'136 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q134 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace> if x then invalidate_tlb_by_asid word else return () \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'136 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace> when xa (invalidateTLBByASID word) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pte (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>\<lambda>xe. (\<lambda>a. word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> unique_table_refs (caps_of_state a) \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_arch_state a \<and> (\<exists>pd. vspace_at_asid word pd a)) and ?Q134 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pteBits - 1)) (addrFromPPtr y)) \<lbrace>\<lambda>xf. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'136 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q114 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'116 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and ?Q95 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 10. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
A total of 20 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>rv s. valid_asid_map s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> unique_table_refs (caps_of_state s) \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> valid_arch_state s \<and> (\<exists>x. vspace_at_asid word x s) \<and> True\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>_. K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc rv sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; (K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) sa\<rbrakk> \<Longrightarrow> valid_asid_map sa \<and> valid_vspace_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> unique_table_refs (caps_of_state sa) \<and> valid_global_objs sa \<and> valid_vs_lookup sa \<and> valid_arch_state sa \<and> (\<exists>x. vspace_at_asid word x sa) \<and> True
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc rv sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc; (K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) sa\<rbrakk> \<Longrightarrow> valid_asid_map sa \<and> valid_vspace_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> unique_table_refs (caps_of_state sa) \<and> valid_global_objs sa \<and> valid_vs_lookup sa \<and> valid_arch_state sa \<and> (\<exists>x. vspace_at_asid word x sa) \<and> True
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>_. K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>_. K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'249 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc pda. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P296 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb pda\<rbrace> mapM (swp store_pte ARM_A.InvalidPTE) ys \<lbrace>\<lambda>rv. vspace_at_asid word pda\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePTE ac) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace> store_pte y ab \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pte_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) sa \<and> (invs and (\<lambda>s. \<exists>a b. cte_wp_at (\<lambda>c. (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs c \<and> is_pt_cap c) (a, b) s)) sa \<and> (\<exists>xc. ?P296 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xb xc sa))\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'97 word cap a b c' ab ac s s' y ys aa ba pd ref x xa xc\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> store_pte y ab \<lbrace>\<lambda>xb s. (\<forall>y\<in>set ys. pte_at y s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> invs s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs c \<and> is_pt_cap c) (a, b) s) \<and> (\<exists>x. vspace_at_asid word x s)\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref xa capa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; caps_of_state s (aa, ba) = Some capa; parent_for_refs (Inl (ab, y # ys)) capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> store_pte y ab \<lbrace>\<lambda>xb s. (\<forall>y\<in>set ys. pte_at y s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> invs s \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pt_cap cap) \<and> (\<exists>x. vspace_at_asid word x s)\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace> storePTE y ac \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pte_check_if_mapped y \<lbrace>\<lambda>x. pte_at y and pspace_aligned and valid_etcbs and ?Q73 word cap a b c' ab ac s s' y ys aa ba pd ref x\<rbrace>
 4. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'75 word cap a b c' ab ac s s' y ys aa ba pd ref xa\<rbrace>
 5. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and ?Q66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
A total of 14 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s\<rbrakk> \<Longrightarrow> \<lbrace>?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref\<rbrace> pteCheckIfMapped y \<lbrace>\<lambda>xa s. pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True\<rbrace>
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and (pte_at y and pspace_aligned and valid_etcbs and (\<lambda>s. (\<forall>x\<in>set ys. pte_at x s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> (invs and (\<lambda>s. (\<exists>ref. (ref \<rhd> (y && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte ab s) and (\<lambda>s. wellformed_pte ab) and (\<lambda>s. \<exists>slot asid. caps_of_state s slot = Some (cap.ArchObjectCap (arch_cap.PageTableCap (y && ~~ mask pt_bits) asid)) \<and> (ab = ARM_A.InvalidPTE \<or> asid \<noteq> None)) and (\<lambda>s. \<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages ab = Some q \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref))))) s \<and> (\<exists>x xa xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x s)))) sa
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'66 word cap a b c' ab ac s s' y ys aa ba pd ref) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s = sa\<rbrakk> \<Longrightarrow> (pte_at y and (pte_at y and pspace_aligned and valid_etcbs and (\<lambda>s. (\<forall>x\<in>set ys. pte_at x s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> (invs and (\<lambda>s. (\<exists>ref. (ref \<rhd> (y && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte ab s) and (\<lambda>s. wellformed_pte ab) and (\<lambda>s. \<exists>slot asid. caps_of_state s slot = Some (cap.ArchObjectCap (arch_cap.PageTableCap (y && ~~ mask pt_bits) asid)) \<and> (ab = ARM_A.InvalidPTE \<or> asid \<noteq> None)) and (\<lambda>s. \<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages ab = Some q \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref))))) s \<and> (\<exists>x xa xb. caps_of_state s (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x s)))) sa
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>a b asid. caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageTableCap (y && ~~ mask pt_bits) asid)) \<and> (ab = ARM_A.InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))) \<and> (\<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> (\<forall>q. pte_ref_pages ab = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<exists>a b asid. caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageTableCap (y && ~~ mask pt_bits) asid)) \<and> (ab = ARM_A.InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> (\<forall>q. pte_ref_pages ab = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<exists>asid. caps_of_state sa (aa, ba) = Some (cap.ArchObjectCap (arch_cap.PageTableCap (y && ~~ mask pt_bits) asid)) \<and> (ab = ARM_A.InvalidPTE \<or> (\<exists>a b. asid = Some (a, b)))
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> (\<forall>q. pte_ref_pages ab = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> (\<forall>q. pte_ref_pages ab = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref)))) \<and> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> (\<forall>q. pte_ref_pages ab = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref)))
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya refa q. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya; (refa \<rhd> (y && ~~ mask pt_bits)) sa; pte_ref_pages ab = Some q\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # refa)
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya refa q. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya; (refa \<rhd> (y && ~~ mask pt_bits)) sa; pte_ref_pages ab = Some q; (\<exists>p. pte_ref_pages ab = Some p \<and> p \<in> obj_refs cap) \<and> (\<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref))\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # refa)
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya refa q. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya; (refa \<rhd> (y && ~~ mask pt_bits)) sa; pte_ref_pages ab = Some q; (\<exists>p. pte_ref_pages ab = Some p \<and> p \<in> obj_refs cap) \<and> (\<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref))\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # refa)
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya refa q p. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya; (refa \<rhd> (y && ~~ mask pt_bits)) sa; pte_ref_pages ab = Some q; \<forall>ref. (ref \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # ref); pte_ref_pages ab = Some p; p \<in> obj_refs cap\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # refa)
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya refa q p. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya; (refa \<rhd> (y && ~~ mask pt_bits)) sa; pte_ref_pages ab = Some q; pte_ref_pages ab = Some p; p \<in> obj_refs cap; (refa \<rhd> (y && ~~ mask pt_bits)) sa \<longrightarrow> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # refa)\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state sa (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (y && mask pt_bits >> 2) (Some APageTable) # refa)
 2. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' ab ac s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab sa; sa \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) sa; pte_at y sa; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) sa) \<and> pte_at p sa; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pt_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs capa; is_pt_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<exists>x xa xb. caps_of_state sa (x, xa) = Some xb \<and> (\<lambda>x. x && ~~ mask pt_bits) ` set ys \<subseteq> obj_refs xb \<and> is_pt_cap xb
 2. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' ab ac s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inl (ab, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inl (ac, y # ys)); cap_relation cap c'; pte_relation' ab ac; (s, s') \<in> state_relation; invs s; invs' s'; valid_pte' ac s'; same_refs (Inl (ab, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inl (ac, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pte ab; valid_pte ab s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inl (ab, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pt_bits)) s; pte_at y s; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<and> pte_at p s; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 2. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b sum c' m' rv rv' ba. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 6. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b sum c' m' rv rv' ba aa bb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; dc rv rv'; sum = Inr ba; ba = (aa, bb)\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte ARM_A.InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde ARM_A.InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- case m' of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (head slots));
when tlbFlush $ invalidateTLBByASID word
od;
return []
od)
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 6. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b c' aaa bb ab. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, bb)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, bb)); cap_relation cap c'; pde_relation' aaa ab\<rbrakk> \<Longrightarrow> corres (=) (invs and ((\<lambda>s. caps_of_state s (a, b) = Some cap) and same_refs (Inr (aaa, bb)) cap and (\<lambda>s. (\<exists>y ys. bb = y # ys) \<and> (\<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> wellformed_pde aaa \<and> valid_pde aaa s) and valid_cap cap and (\<lambda>y. is_pg_cap cap \<and> empty_refs (Inr (aaa, bb)) \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0) and (\<lambda>s. \<exists>a b. cte_wp_at (parent_for_refs (Inr (aaa, bb))) (a, b) s) and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) (invs' and valid_pde' ab and pspace_aligned' and valid_slots_duplicated' (Inr (ab, bb)) and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) aaa;
y <- mapM (swp store_pde ARM_A.InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- do tlbFlush <- pdeCheckIfMapped (hd bb);
y <- mapM (swp storePDE ab) bb;
y <- doMachineOp (cleanCacheRange_PoU (hd bb) (last bb + (2 ^ pdeBits - 1)) (addrFromPPtr (hd bb)));
when tlbFlush (invalidateTLBByASID word)
od;
return []
od)
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 6. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b c' aaa bb ab s s'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, bb)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, bb)); cap_relation cap c'; pde_relation' aaa ab; (invs and ((\<lambda>s. caps_of_state s (a, b) = Some cap) and same_refs (Inr (aaa, bb)) cap and (\<lambda>s. (\<exists>y ys. bb = y # ys) \<and> (\<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots) \<and> wellformed_pde aaa \<and> valid_pde aaa s) and valid_cap cap and (\<lambda>y. is_pg_cap cap \<and> empty_refs (Inr (aaa, bb)) \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0) and (\<lambda>s. \<exists>a b. cte_wp_at (parent_for_refs (Inr (aaa, bb))) (a, b) s) and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)) s; (invs' and valid_pde' ab and pspace_aligned' and valid_slots_duplicated' (Inr (ab, bb)) and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> corres (=) ((=) s) ((=) s') (do y <- do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) aaa;
y <- mapM (swp store_pde ARM_A.InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od) (do y <- do tlbFlush <- pdeCheckIfMapped (hd bb);
y <- mapM (swp storePDE ab) bb;
y <- doMachineOp (cleanCacheRange_PoU (hd bb) (last bb + (2 ^ pdeBits - 1)) (addrFromPPtr (hd bb)));
when tlbFlush (invalidateTLBByASID word)
od;
return []
od)
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 6. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> corres (=) ((=) s) ((=) s') (do x <- pde_check_if_mapped y;
xa <- store_pde y aaa;
xa <- mapM (swp store_pde ARM_A.InvalidPDE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- pdeCheckIfMapped y;
xa <- storePDE y ab;
ysa <- mapM (swp storePDE ab) ys;
xa <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when x (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 6. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> corres (=) (?Q778 word cap a b c' aaa ab s s' y ys aa ba pd ref) (?Q'778 word cap a b c' aaa ab s s' y ys aa ba pd ref) (do x <- pde_check_if_mapped y;
xa <- store_pde y aaa;
xa <- mapM (swp store_pde ARM_A.InvalidPDE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- pdeCheckIfMapped y;
xa <- storePDE y ab;
ysa <- mapM (swp storePDE ab) ys;
xa <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when x (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> ?Q778 word cap a b c' aaa ab s s' y ys aa ba pd ref sa
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ?Q'778 word cap a b c' aaa ab s s' y ys aa ba pd ref sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (12 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> corres (=) (?R782 word cap a b c' aaa ab s s' y ys aa ba pd ref x) (?R'782 word cap a b c' aaa ab s s' y ys aa ba pd ref xa) (do xa <- store_pde y aaa;
xa <- mapM (swp store_pde ARM_A.InvalidPDE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- storePDE y ab;
ysa <- mapM (swp storePDE ab) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>?R782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>?R'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 10. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> corres (?r'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa) (?P788 word cap a b c' aaa ab s s' y ys aa ba pd ref x) (?P'790 word cap a b c' aaa ab s s' y ys aa ba pd ref xa) (store_pde y aaa) (storePDE y ab)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; ?r'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc\<rbrakk> \<Longrightarrow> corres (=) (?R787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb) (?R'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc) (do xa <- mapM (swp store_pde ARM_A.InvalidPDE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do ysa <- mapM (swp storePDE ab) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>?R787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>?R'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. ?P788 word cap a b c' aaa ab s s' y ys aa ba pd ref x and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. ?P'790 word cap a b c' aaa ab s s' y ys aa ba pd ref xa and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> pde_relation_aligned (y >> 2) aaa ab
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> corres (=) (?R787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb) (?R'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc) (do xa <- mapM (swp store_pde ARM_A.InvalidPDE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do ysa <- mapM (swp storePDE ab) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>?R787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>?R'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> corres (=) (?R787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb) (?R'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc) (do xa <- mapM (swp store_pde ARM_A.InvalidPDE) ys;
xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do ysa <- mapM (swp storePDE ab) ys;
x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>?R787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>?R'787 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> corres dc (?P810 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb) (?P'812 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc) (mapM (swp store_pde ARM_A.InvalidPDE) ys) (mapM (swp storePDE ab) ys)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres (=) (?R809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd) (?R'809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa) (do xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>?R809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>?R'809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. ?P810 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. ?P'812 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<forall>slot\<in>set ys. \<not> is_aligned (slot >> 2) (pde_align' ab)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres (=) (?R809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd) (?R'809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa) (do xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>?R809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>?R'809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres (=) (?R809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd) (?R'809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa) (do xa <- do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y));
y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do x <- doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y));
y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>?R809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>?R'809 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> corres dc (?P829 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd) (?P'831 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa) (do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y))) (doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)))
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. ?P829 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. ?P'831 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
A total of 19 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y) = cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa rv. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> dc rv rv
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y))
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa rv. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> dc rv rv
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y))
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y))
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres (=) (?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (do y <- if x then invalidate_tlb_by_asid word else return ();
return []
od) (do y <- when xa (invalidateTLBByASID word);
return []
od)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>?R828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>?R'828 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> corres dc (?P849 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe) (?P'851 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf) (if x then invalidate_tlb_by_asid word else return ()) (when xa (invalidateTLBByASID word))
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q850 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace> if x then invalidate_tlb_by_asid word else return () \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'852 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace> when xa (invalidateTLBByASID word) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>\<lambda>xe. ?P849 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe and ?Q850 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>\<lambda>xf. ?P'851 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf and ?Q'852 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref xa xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; xa\<rbrakk> \<Longrightarrow> corres dc (?P849 word cap a b c' aaa ab s s' y ys aa ba pd ref True True () () xd ysa ()) (?P'851 word cap a b c' aaa ab s s' y ys aa ba pd ref True True () () xd ysa ()) (invalidate_tlb_by_asid word) (invalidateTLBByASID word)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q850 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace> if x then invalidate_tlb_by_asid word else return () \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'852 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace> when xa (invalidateTLBByASID word) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>\<lambda>xe. ?P849 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe and ?Q850 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>\<lambda>xf. ?P'851 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf and ?Q'852 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q850 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace> if x then invalidate_tlb_by_asid word else return () \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe xf. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa; dc xe xf\<rbrakk> \<Longrightarrow> \<lbrace>?Q'852 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace> when xa (invalidateTLBByASID word) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace> do_machine_op (cleanCacheRange_PoU y (last_byte_pde (if ys = [] then y else last ys)) (addrFromPPtr y)) \<lbrace>\<lambda>xe. (\<lambda>a. word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> valid_asid_map a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> unique_table_refs (caps_of_state a) \<and> valid_global_objs a \<and> valid_vs_lookup a \<and> valid_arch_state a \<and> (\<exists>pd. vspace_at_asid word pd a)) and ?Q850 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xe\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; dc xd ysa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace> doMachineOp (cleanCacheRange_PoU y ((if ys = [] then y else last ys) + (2 ^ pdeBits - 1)) (addrFromPPtr y)) \<lbrace>\<lambda>xf. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'852 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd ysa xf\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?Q830 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc xd\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and ?Q'832 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc ysa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and ?Q811 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 10. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
A total of 19 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>rv s. valid_asid_map s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> unique_table_refs (caps_of_state s) \<and> valid_global_objs s \<and> valid_vs_lookup s \<and> valid_arch_state s \<and> (\<exists>x. vspace_at_asid word x s) \<and> True\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>_. K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc rv sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; (K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) sa\<rbrakk> \<Longrightarrow> valid_asid_map sa \<and> valid_vspace_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> unique_table_refs (caps_of_state sa) \<and> valid_global_objs sa \<and> valid_vs_lookup sa \<and> valid_arch_state sa \<and> (\<exists>x. vspace_at_asid word x sa) \<and> True
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc rv sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc; (K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)) sa\<rbrakk> \<Longrightarrow> valid_asid_map sa \<and> valid_vspace_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> unique_table_refs (caps_of_state sa) \<and> valid_global_objs sa \<and> valid_vs_lookup sa \<and> valid_arch_state sa \<and> (\<exists>x. vspace_at_asid word x sa) \<and> True
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>_. K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>_. K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) and invs and (\<lambda>s. \<exists>pd. vspace_at_asid word pd s)\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> ?P'965 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb sa)\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc pda. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?P1003 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb pda\<rbrace> mapM (swp store_pde ARM_A.InvalidPDE) ys \<lbrace>\<lambda>rv. vspace_at_asid word pda\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa; dc xb xc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace> mapM (swp storePDE ab) ys \<lbrace>\<lambda>ysa. (\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True)\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb. (\<lambda>s. \<forall>y\<in>set ys. pde_at y s) and pspace_aligned and valid_etcbs and (\<lambda>sa. True \<and> word \<le> mask local.asid_bits \<and> word \<noteq> 0 \<and> K (word \<le> mask local.asid_bits \<and> word \<noteq> 0) sa \<and> (invs and (\<lambda>s. \<forall>sl\<in>set ys. UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and (\<lambda>s. \<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s)) sa \<and> (\<exists>xc. ?P1003 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xb xc sa))\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ?Q'813 word cap a b c' aaa ab s s' y ys aa ba pd ref x xa xc\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 10. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb s. (\<forall>y\<in>set ys. pde_at y s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> invs s \<and> (\<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s) \<and> (\<exists>x. vspace_at_asid word x s)\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref xa capa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state s (aa, ba) = Some capa; parent_for_refs (Inr (aaa, y # ys)) capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> store_pde y aaa \<lbrace>\<lambda>xb s. (\<forall>y\<in>set ys. pde_at y s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> invs s \<and> (\<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s) \<and> (\<exists>x. vspace_at_asid word x s)\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and ?Q789 word cap a b c' aaa ab s s' y ys aa ba pd ref x\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref xa capa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state s (aa, ba) = Some capa; parent_for_refs (Inr (aaa, y # ys)) capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'1065 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> store_pde y aaa \<lbrace>\<lambda>rv s. invs s \<and> (\<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s) \<and> (\<exists>x. vspace_at_asid word x s)\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and (\<lambda>sa. (\<forall>x\<in>set ys. pde_at x sa) \<and> pspace_aligned sa \<and> valid_etcbs sa \<and> ?P'1065 word cap a b c' aaa ab s s' y ys aa ba pd ref x sa)\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref xa capa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state s (aa, ba) = Some capa; parent_for_refs (Inr (aaa, y # ys)) capa\<rbrakk> \<Longrightarrow> \<lbrace>?P1069 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> store_pde y aaa \<lbrace>\<lambda>rv. invs\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref xa capa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state s (aa, ba) = Some capa; parent_for_refs (Inr (aaa, y # ys)) capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'1070 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> store_pde y aaa \<lbrace>\<lambda>rv s. (\<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s) \<and> (\<exists>x. vspace_at_asid word x s)\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and (\<lambda>sa. (\<forall>x\<in>set ys. pde_at x sa) \<and> pspace_aligned sa \<and> valid_etcbs sa \<and> ?P1069 word cap a b c' aaa ab s s' y ys aa ba pd ref x sa \<and> ?P'1070 word cap a b c' aaa ab s s' y ys aa ba pd ref x sa)\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 9. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref xa capa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state s (aa, ba) = Some capa; parent_for_refs (Inr (aaa, y # ys)) capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'1070 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> store_pde y aaa \<lbrace>\<lambda>rv s. (\<forall>sl\<in>set ys. sl && ~~ mask pd_bits \<notin> global_refs s) \<and> (\<exists>x. vspace_at_asid word x s)\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and (\<lambda>sa. (\<forall>x\<in>set ys. pde_at x sa) \<and> pspace_aligned sa \<and> valid_etcbs sa \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> (y && ~~ mask pd_bits)) s) and (\<lambda>s. \<exists>slot. cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) slot s) and (\<lambda>s. \<exists>ptr cap. caps_of_state s ptr = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap s) and valid_pde aaa and (\<lambda>s. y && ~~ mask pd_bits \<notin> global_refs s) and K (wellformed_pde aaa \<and> pde_ref aaa = None) and K (UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. y # ys = y # xs)) and (\<lambda>s. \<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) s)) sa \<and> ?P'1070 word cap a b c' aaa ab s s' y ys aa ba pd ref x sa)\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 8. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 10. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref x xa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; x = xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace> storePDE y ab \<lbrace>\<lambda>xc. pspace_aligned' and pspace_distinct' and ((\<lambda>_. True) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> True))\<rbrace>
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pde_check_if_mapped y \<lbrace>\<lambda>x. pde_at y and pspace_aligned and valid_etcbs and (\<lambda>s. (\<forall>x\<in>set ys. pde_at x s) \<and> pspace_aligned s \<and> valid_etcbs s \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> (y && ~~ mask pd_bits)) s) and (\<lambda>s. \<exists>slot. cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) slot s) and (\<lambda>s. \<exists>ptr cap. caps_of_state s ptr = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap s) and valid_pde aaa and (\<lambda>s. y && ~~ mask pd_bits \<notin> global_refs s) and K (wellformed_pde aaa \<and> pde_ref aaa = None) and K (UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> (\<exists>xs. y # ys = y # xs)) and (\<lambda>s. \<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) s)) s \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs s) \<and> (\<exists>x. vspace_at_asid word x s))\<rbrace>
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref\<rbrace> pdeCheckIfMapped y \<lbrace>\<lambda>xa. pspace_aligned' and pspace_distinct' and ?Q'791 word cap a b c' aaa ab s s' y ys aa ba pd ref xa\<rbrace>
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> (pde_at y and ?Q782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and ?Q'782 word cap a b c' aaa ab s s' y ys aa ba pd ref) sa
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 10. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 12 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) sa; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s = sa\<rbrakk> \<Longrightarrow> pspace_aligned sa \<and> (\<exists>ref. (ref \<rhd> (y && ~~ mask pd_bits)) sa) \<and> (\<exists>a b. cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (a, b) sa) \<and> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap sa) \<and> y && ~~ mask pd_bits \<notin> global_refs sa \<and> pde_ref aaa = None \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>ref. (ref \<rhd> (y && ~~ mask pd_bits)) sa) \<and> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> y && ~~ mask pd_bits \<in> obj_refs cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y)) \<and> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap sa) \<and> y && ~~ mask pd_bits \<notin> global_refs sa \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> y && ~~ mask pd_bits \<in> obj_refs cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y)) \<and> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap sa) \<and> y && ~~ mask pd_bits \<notin> global_refs sa \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> y && ~~ mask pd_bits \<in> obj_refs cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y)
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap sa) \<and> y && ~~ mask pd_bits \<notin> global_refs sa \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state sa (aa, ba) = Some cap \<and> y && ~~ mask pd_bits \<in> obj_refs cap \<and> (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs cap \<and> is_pd_cap cap \<and> (\<exists>y. cap_asid cap = Some y)
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap sa) \<and> y && ~~ mask pd_bits \<notin> global_refs sa \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap sa) \<and> y && ~~ mask pd_bits \<notin> global_refs sa \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> is_pg_cap cap \<and> same_refs (Inr (aaa, y # ys)) cap sa
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> y && ~~ mask pd_bits \<notin> global_refs sa \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> y && ~~ mask pd_bits \<notin> global_refs sa \<and> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> y && ~~ mask pd_bits \<notin> global_refs sa
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya pda. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> (\<exists>ko. kheap sa (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); y && ~~ mask pd_bits \<in> global_refs sa\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (12 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya pda. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> (\<exists>ko. kheap sa (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); y && ~~ mask pd_bits \<in> global_refs sa\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) (aa, ba) sa
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya pda. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> (\<exists>ko. kheap sa (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); y && ~~ mask pd_bits \<in> global_refs sa\<rbrakk> \<Longrightarrow> ?r1178 word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya pda \<in> global_refs sa
 3. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya pda. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> (\<exists>ko. kheap sa (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); y && ~~ mask pd_bits \<in> global_refs sa; ?r1178 word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya pda \<notin> cap_range capa\<rbrakk> \<Longrightarrow> False
 4. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 5. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 7. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 9. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 10. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya pda. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> (\<exists>ko. kheap sa (p && ~~ mask pd_bits) = Some ko \<and> a_type ko = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); y && ~~ mask pd_bits \<in> global_refs sa; y && ~~ mask pd_bits \<notin> cap_range capa\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa) \<and> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<exists>pd. ako_at (PageDirectory pd) (y && ~~ mask pd_bits) sa
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya ko. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> (\<exists>ko. kheap sa (p && ~~ mask pd_bits) = Some ko \<and> (case ko of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory) \<and> is_aligned p 2 \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; kheap sa (y && ~~ mask pd_bits) = Some ko; (case ko of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of arch_kernel_obj.ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageDirectory\<rbrakk> \<Longrightarrow> \<exists>pd. ko = ArchObj (PageDirectory pd)
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 3. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 8. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa) \<and> (\<exists>x. vspace_at_asid word x sa)
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) sa) \<and> pde_at p sa \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ys. x && ~~ mask pd_bits \<notin> global_refs sa
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; caps_of_state sa (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) sa; pde_at y sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; caps_of_state sa (aa, ba) = Some capa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; x \<in> set ys; (\<exists>ref. (ref \<rhd> (x && ~~ mask pd_bits)) sa) \<and> pde_at x sa \<and> UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> x && ~~ mask pd_bits \<notin> global_refs sa
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; x \<in> set ys; is_aligned y 2; (refa \<rhd> (x && ~~ mask pd_bits)) sa; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned x 2; UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap sa (x && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); x && ~~ mask pd_bits \<in> global_refs sa\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; x \<in> set ys; is_aligned y 2; (refa \<rhd> (x && ~~ mask pd_bits)) sa; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned x 2; UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap sa (x && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); x && ~~ mask pd_bits \<in> global_refs sa\<rbrakk> \<Longrightarrow> cte_wp_at ((=) capa) (aa, ba) sa
 2. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; x \<in> set ys; is_aligned y 2; (refa \<rhd> (x && ~~ mask pd_bits)) sa; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned x 2; UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap sa (x && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); x && ~~ mask pd_bits \<in> global_refs sa\<rbrakk> \<Longrightarrow> ?r1367 word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb \<in> global_refs sa
 3. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; x \<in> set ys; is_aligned y 2; (refa \<rhd> (x && ~~ mask pd_bits)) sa; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned x 2; UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap sa (x && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); x && ~~ mask pd_bits \<in> global_refs sa; ?r1367 word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb \<notin> cap_range capa\<rbrakk> \<Longrightarrow> False
 4. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 6. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 7. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 8. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 9. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; x \<in> set ys; is_aligned y 2; (refa \<rhd> (x && ~~ mask pd_bits)) sa; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned x 2; UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap sa (x && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); x && ~~ mask pd_bits \<in> global_refs sa; x && ~~ mask pd_bits \<notin> cap_range capa\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; (\<lambda>x. x && ~~ mask pd_bits) ` set ys \<subseteq> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; (refa \<rhd> (x && ~~ mask pd_bits)) sa; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned x 2; UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap sa (x && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); x && ~~ mask pd_bits \<in> global_refs sa; x && ~~ mask pd_bits \<notin> cap_range capa; x && ~~ mask pd_bits \<in> (\<lambda>x. x && ~~ mask pd_bits) ` set ys\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b c' aaa ab s' y ys aa ba pd ref sa capa ya x refa pda pdb. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (sa, s') \<in> state_relation; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap sa; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa sa; sa \<turnstile> cap; is_pg_cap cap; pde_ref aaa = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd sa; valid_etcbs sa; cte_wp_at ((=) cap) (a, b) sa; (ref \<rhd> (y && ~~ mask pd_bits)) sa; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; cte_wp_at ((=) capa) (aa, ba) sa; y && ~~ mask pd_bits \<in> obj_refs capa; is_pd_cap capa; cap_asid capa = Some ya; is_aligned y 2; (refa \<rhd> (x && ~~ mask pd_bits)) sa; kheap sa (y && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pda)); is_aligned x 2; UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2) \<notin> kernel_mapping_slots; kheap sa (x && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pdb)); x && ~~ mask pd_bits \<in> global_refs sa; x && ~~ mask pd_bits \<notin> cap_range capa; x && ~~ mask pd_bits \<in> (\<lambda>x. x && ~~ mask pd_bits) ` set ys; x && ~~ mask pd_bits \<in> obj_refs capa\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 4. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 6. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 7. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b c' aaa ab s s' y ys aa ba pd ref sa. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) (Inr (aaa, y # ys)); pgi' = ARM_H.PageMap word c' (cte_map (a, b)) (Inr (ab, y # ys)); cap_relation cap c'; pde_relation' aaa ab; (s, s') \<in> state_relation; invs s; invs' s'; valid_pde' ab s'; same_refs (Inr (aaa, y # ys)) cap s; pspace_aligned' s'; valid_slots_duplicated' (Inr (ab, y # ys)) s'; pspace_distinct' s'; vs_valid_duplicates' (ksPSpace s'); wellformed_pde aaa; valid_pde aaa s; s \<turnstile> cap; is_pg_cap cap; empty_refs (Inr (aaa, y # ys)); word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (aaa, y # ys))) (aa, ba) s; vspace_at_asid word pd s; valid_etcbs s; caps_of_state s (a, b) = Some cap; (ref \<rhd> (y && ~~ mask pd_bits)) s; pde_at y s; UCAST(32 \<rightarrow> 12) (y && mask pd_bits >> 2) \<notin> kernel_mapping_slots; \<forall>p\<in>set ys. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 3. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 5. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 6. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (7 subgoals):
 1. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 word cap a b sum c' m'\<rbrace> set_cap cap (a, b) \<lbrace>\<lambda>_. invs and valid_page_map_inv word cap (a, b) sum and valid_etcbs and (\<lambda>s. caps_of_state s (a, b) = Some cap)\<rbrace>
 2. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 3. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and ?Q14 word cap a b sum c' m') s
 4. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 5. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>word cap a b sum c' m'. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'14 word cap a b sum c' m'\<rbrace> updateCap (cte_map (a, b)) c' \<lbrace>\<lambda>_. invs' and valid_slots' m' and pspace_aligned' and valid_slots_duplicated' m' and pspace_distinct' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 2. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and (\<lambda>s. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and valid_cap cap) s \<and> valid_page_inv (ARM_A.PageMap word cap (a, b) sum) s \<and> valid_etcbs s \<and> ((caps_of_state s)((a, b) \<mapsto> cap)) (a, b) = Some cap)) s
 3. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'14 word cap a b sum c' m') s
 4. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs and valid_etcbs and valid_page_inv (ARM_A.PageMap word cap (a, b) sum)) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and (\<lambda>s. (cte_wp_at (is_arch_update cap and (\<lambda>c. \<forall>r. vs_cap_ref c = Some r \<longrightarrow> vs_cap_ref cap = Some r)) (a, b) and invs and valid_cap cap) s \<and> valid_page_inv (ARM_A.PageMap word cap (a, b) sum) s \<and> valid_etcbs s \<and> ((caps_of_state s)((a, b) \<mapsto> cap)) (a, b) = Some cap)) s
 2. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and (\<lambda>s. (cte_wp_at' (is_arch_update' c') (cte_map (a, b)) and invs' and valid_cap' c') s \<and> valid_slots' m' s \<and> pspace_aligned' s \<and> valid_slots_duplicated' m' s \<and> pspace_distinct' s \<and> vs_valid_duplicates' (ksPSpace s))) s
 3. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>word a b sum m' s dev p R sz m deva pa Ra sza ma ab pd ba capc r. \<lbrakk>pgi = ARM_A.PageMap word (cap.ArchObjectCap (arch_cap.PageCap deva pa Ra sza ma)) (a, b) sum; pgi' = ARM_H.PageMap word (capability.ArchObjectCap (arch_capability.PageCap deva pa (vmrights_map Ra) sza ma)) (cte_map (a, b)) m'; mapping_map sum m'; invs s; valid_etcbs s; same_refs sum (cap.ArchObjectCap (arch_cap.PageCap dev p R sz m)) s; cap_master_cap (cap.ArchObjectCap (arch_cap.PageCap deva pa Ra sza ma)) = cap_master_cap (cap.ArchObjectCap (arch_cap.PageCap dev p R sz m)); same_refs sum (cap.ArchObjectCap (arch_cap.PageCap deva pa Ra sza ma)) s; caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev p R sz m)); valid_slots sum s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap deva pa Ra sza ma); empty_refs sum; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; caps_of_state s (ab, ba) = Some capc; parent_for_refs sum capc; vs_cap_ref (cap.ArchObjectCap (arch_cap.PageCap dev p R sz m)) = Some r\<rbrakk> \<Longrightarrow> vs_cap_ref (cap.ArchObjectCap (arch_cap.PageCap deva pa Ra sza ma)) = Some r
 2. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and (\<lambda>s. (cte_wp_at' (is_arch_update' c') (cte_map (a, b)) and invs' and valid_cap' c') s \<and> valid_slots' m' s \<and> pspace_aligned' s \<and> valid_slots_duplicated' m' s \<and> pspace_distinct' s \<and> vs_valid_duplicates' (ksPSpace s))) s
 3. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>word cap a b sum c' m' s. \<lbrakk>pgi = ARM_A.PageMap word cap (a, b) sum; pgi' = ARM_H.PageMap word c' (cte_map (a, b)) m'; cap_relation cap c'; mapping_map sum m'; (invs' and valid_page_inv' (ARM_H.PageMap word c' (cte_map (a, b)) m') and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and (\<lambda>s. (cte_wp_at' (is_arch_update' c') (cte_map (a, b)) and invs' and valid_cap' c') s \<and> valid_slots' m' s \<and> pspace_aligned' s \<and> valid_slots_duplicated' m' s \<and> pspace_distinct' s \<and> vs_valid_duplicates' (ksPSpace s))) s
 2. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>x21 x22. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>x21 a b c'. \<lbrakk>pgi = ARM_A.PageUnmap x21 (a, b); acap_relation x21 c'; pgi' = ARM_H.PageUnmap c' (cte_map (a, b))\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv (ARM_A.PageUnmap x21 (a, b))) (invs' and valid_page_inv' (ARM_H.PageUnmap c' (cte_map (a, b))) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x21 of arch_cap.PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap (a, b);
set_cap (cap.ArchObjectCap $ update_map_data cap None) (a, b);
return []
od | _ \<Rightarrow> fail) (do y <- case capVPMappedAddress c' of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage (capVPSize c') asid vaddr (capVPBasePtr c');
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>x21 a b c' s s'. \<lbrakk>pgi = ARM_A.PageUnmap x21 (a, b); acap_relation x21 c'; pgi' = ARM_H.PageUnmap c' (cte_map (a, b)); (invs and valid_etcbs and valid_page_inv (ARM_A.PageUnmap x21 (a, b))) s; (invs' and valid_page_inv' (ARM_H.PageUnmap c' (cte_map (a, b))) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv (ARM_A.PageUnmap x21 (a, b))) (invs' and valid_page_inv' (ARM_H.PageUnmap c' (cte_map (a, b))) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x21 of arch_cap.PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ get_cap (a, b);
set_cap (cap.ArchObjectCap $ update_map_data cap None) (a, b);
return []
od | _ \<Rightarrow> fail) (do y <- case capVPMappedAddress c' of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage (capVPSize c') asid vaddr (capVPBasePtr c');
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m)\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = None\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> corres (=) (?Q1502 a b s s' dev r R sz m) (?Q'1502 a b s s' dev r R sz m) (do cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> ?Q1502 a b s s' dev r R sz m sa
 3. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> ?Q'1502 a b s s' dev r R sz m sa
 4. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> corres acap_relation (?P1506 a b s s' dev r R sz m) (?P'1506 a b s s' dev r R sz m) (liftM the_arch_cap (get_cap (a, b))) (liftM capCap (getSlotCap (cte_map (a, b))))
 2. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1506 a b s s' dev r R sz m cap) (?R'1506 a b s s' dev r R sz m capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 3. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1506 a b s s' dev r R sz m\<rbrace>
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1506 a b s s' dev r R sz m\<rbrace>
 5. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (?P1506 a b s s' dev r R sz m and ?Q1506 a b s s' dev r R sz m) sa
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (?P'1506 a b s s' dev r R sz m and ?Q'1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> corres ((\<lambda>x. acap_relation x \<circ> capCap) \<circ> the_arch_cap) (?P1506 a b s s' dev r R sz None) (?P'1506 a b s s' dev r R sz None) (get_cap (a, b)) (getSlotCap (cte_map (a, b)))
 2. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1506 a b s s' dev r R sz m cap) (?R'1506 a b s s' dev r R sz m capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 3. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1506 a b s s' dev r R sz m\<rbrace>
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1506 a b s s' dev r R sz m\<rbrace>
 5. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (?P1506 a b s s' dev r R sz m and ?Q1506 a b s s' dev r R sz m) sa
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (?P'1506 a b s s' dev r R sz m and ?Q'1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> corres (?r'1511 a b s s' dev r R sz m) (?P1506 a b s s' dev r R sz None) (?P'1506 a b s s' dev r R sz None) (get_cap (a, b)) (getSlotCap (cte_map (a, b)))
 2. \<And>a b s s' dev r R sz m x y. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; ?r'1511 a b s s' dev r R sz m x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. acap_relation x \<circ> capCap) \<circ> the_arch_cap) x y
 3. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1506 a b s s' dev r R sz m cap) (?R'1506 a b s s' dev r R sz m capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1506 a b s s' dev r R sz m\<rbrace>
 5. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1506 a b s s' dev r R sz m\<rbrace>
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (?P1506 a b s s' dev r R sz m and ?Q1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (?P'1506 a b s s' dev r R sz m and ?Q'1506 a b s s' dev r R sz m) sa
 8. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>a b s s' dev r R sz m x y. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; cap_relation x y \<and> is_arch_cap x\<rbrakk> \<Longrightarrow> ((\<lambda>x. acap_relation x \<circ> capCap) \<circ> the_arch_cap) x y
 2. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1506 a b s s' dev r R sz m cap) (?R'1506 a b s s' dev r R sz m capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 3. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1506 a b s s' dev r R sz m\<rbrace>
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1506 a b s s' dev r R sz m\<rbrace>
 5. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (cte_wp_at is_arch_cap (a, b) and ?Q1506 a b s s' dev r R sz m) sa
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1506 a b s s' dev r R sz m cap) (?R'1506 a b s s' dev r R sz m capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 2. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1506 a b s s' dev r R sz m\<rbrace>
 3. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1506 a b s s' dev r R sz m\<rbrace>
 4. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (cte_wp_at is_arch_cap (a, b) and ?Q1506 a b s s' dev r R sz m) sa
 5. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'1506 a b s s' dev r R sz m) sa
 6. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres dc (?P1534 a b s s' dev r R sz m cap) (?P'1536 a b s s' dev r R sz m capa) (set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b)) (updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)))
 2. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1535 a b s s' dev r R sz m cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1537 a b s s' dev r R sz m capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. ?P1534 a b s s' dev r R sz m cap and ?Q1535 a b s s' dev r R sz m cap\<rbrace>
 5. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. ?P'1536 a b s s' dev r R sz m capa and ?Q'1537 a b s s' dev r R sz m capa\<rbrace>
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (cte_wp_at is_arch_cap (a, b) and ?Q1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'1506 a b s s' dev r R sz m) sa
 8. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa; is_page_cap cap\<rbrakk> \<Longrightarrow> corres dc (?P1542 a b s s' dev r R sz m cap) (?P'1536 a b s s' dev r R sz m capa) (set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b)) (updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)))
 2. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1535 a b s s' dev r R sz m cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1537 a b s s' dev r R sz m capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. ?P1542 a b s s' dev r R sz m cap and (\<lambda>s. is_page_cap cap) and ?Q1535 a b s s' dev r R sz m cap\<rbrace>
 5. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. ?P'1536 a b s s' dev r R sz m capa and ?Q'1537 a b s s' dev r R sz m capa\<rbrace>
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (cte_wp_at is_arch_cap (a, b) and ?Q1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'1506 a b s s' dev r R sz m) sa
 8. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa; is_page_cap cap\<rbrakk> \<Longrightarrow> cap_relation (cap.ArchObjectCap (update_map_data cap None)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa))
 2. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1535 a b s s' dev r R sz m cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1537 a b s s' dev r R sz m capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data cap None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and (\<lambda>s. is_page_cap cap) and ?Q1535 a b s s' dev r R sz m cap\<rbrace>
 5. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'1537 a b s s' dev r R sz m capa\<rbrace>
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (cte_wp_at is_arch_cap (a, b) and ?Q1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'1506 a b s s' dev r R sz m) sa
 8. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1535 a b s s' dev r R sz m cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>a b s s' dev r R sz m cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1537 a b s s' dev r R sz m capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q1506 a b s s' dev r R sz m\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data cap None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and (\<lambda>s. is_page_cap cap) and ?Q1535 a b s s' dev r R sz m cap\<rbrace>
 4. \<And>a b s s' dev r R sz m. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1506 a b s s' dev r R sz m\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'1537 a b s s' dev r R sz m capa\<rbrace>
 5. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (cte_wp_at is_arch_cap (a, b) and ?Q1506 a b s s' dev r R sz m) sa
 6. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'1506 a b s s' dev r R sz m) sa
 7. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) sa\<rbrakk> \<Longrightarrow> (cte_wp_at is_arch_cap (a, b) and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) (a, b) s \<longrightarrow> ((\<lambda>cap s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data cap None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) s \<and> is_page_cap cap \<and> True) \<circ> the_arch_cap) cap s)) sa
 2. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)) sa
 3. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>a b s s' dev r R sz sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)); s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); invs sa; valid_etcbs sa; caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)); sa \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)\<rbrakk> \<Longrightarrow> is_arch_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)) \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> cap_master_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)) = cap_master_cap (cap.ArchObjectCap (update_map_data (arch_cap.PageCap dev r R sz None) None)) \<and> \<not> is_reply_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)) \<and> \<not> is_master_reply_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))
 2. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)) sa
 3. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>a b s s' dev r R sz sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)); s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); invs sa; valid_etcbs sa; caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)); sa \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None)\<rbrakk> \<Longrightarrow> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa
 2. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)) sa
 3. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz m sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz None) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz None) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz None))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz None); m = None; (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz None)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)) sa
 2. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>a b s s' dev r R sz m aa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz m) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz m) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s'; case m of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_unmap sz x2; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m); m = Some aa\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz m))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz m)) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmap_page sz asid vaddr r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- case m of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage sz asid vaddr r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- unmap_page sz aa ba r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- unmapPage sz aa ba r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> corres (=) (?Q1758 a b s s' dev r R sz aa ba) (?Q'1758 a b s s' dev r R sz aa ba) (do y <- unmap_page sz aa ba r;
cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- unmapPage sz aa ba r;
cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> ?Q1758 a b s s' dev r R sz aa ba sa
 3. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> ?Q'1758 a b s s' dev r R sz aa ba sa
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> corres (?r'1762 a b s s' dev r R sz aa ba) (?P1762 a b s s' dev r R sz aa ba) (?P'1762 a b s s' dev r R sz aa ba) (unmap_page sz aa ba r) (unmapPage sz aa ba r)
 2. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); ?r'1762 a b s s' dev r R sz aa ba y ya\<rbrakk> \<Longrightarrow> corres (=) (?R1762 a b s s' dev r R sz aa ba y) (?R'1762 a b s s' dev r R sz aa ba ya) (do cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 3. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>?R1762 a b s s' dev r R sz aa ba\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>?R'1762 a b s s' dev r R sz aa ba\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (?P1762 a b s s' dev r R sz aa ba and ?Q1762 a b s s' dev r R sz aa ba) sa
 6. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (?P'1762 a b s s' dev r R sz aa ba and ?Q'1762 a b s s' dev r R sz aa ba) sa
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (7 subgoals):
 1. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> corres (=) (?R1762 a b s s' dev r R sz aa ba y) (?R'1762 a b s s' dev r R sz aa ba ya) (do cap <- liftM the_arch_cap (get_cap (a, b));
y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do cap <- liftM capCap (getSlotCap (cte_map (a, b)));
y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od)
 2. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>?R1762 a b s s' dev r R sz aa ba\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>?R'1762 a b s s' dev r R sz aa ba\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 5. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 7. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> corres acap_relation (?P1769 a b s s' dev r R sz aa ba y) (?P'1771 a b s s' dev r R sz aa ba ya) (liftM the_arch_cap (get_cap (a, b))) (liftM capCap (getSlotCap (cte_map (a, b))))
 2. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1768 a b s s' dev r R sz aa ba y ya cap) (?R'1768 a b s s' dev r R sz aa ba y ya capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 3. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. ?P1769 a b s s' dev r R sz aa ba y and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. ?P'1771 a b s s' dev r R sz aa ba ya and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> corres ((\<lambda>x. acap_relation x \<circ> capCap) \<circ> the_arch_cap) (?P1769 a b s s' dev r R sz aa ba ()) (?P'1771 a b s s' dev r R sz aa ba ()) (get_cap (a, b)) (getSlotCap (cte_map (a, b)))
 2. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1768 a b s s' dev r R sz aa ba y ya cap) (?R'1768 a b s s' dev r R sz aa ba y ya capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 3. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. ?P1769 a b s s' dev r R sz aa ba y and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. ?P'1771 a b s s' dev r R sz aa ba ya and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (11 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> corres (?r'1777 a b s s' dev r R sz aa ba) (?P1769 a b s s' dev r R sz aa ba ()) (?P'1771 a b s s' dev r R sz aa ba ()) (get_cap (a, b)) (getSlotCap (cte_map (a, b)))
 2. \<And>a b s s' dev r R sz aa ba x y. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); ?r'1777 a b s s' dev r R sz aa ba x y\<rbrakk> \<Longrightarrow> ((\<lambda>x. acap_relation x \<circ> capCap) \<circ> the_arch_cap) x y
 3. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1768 a b s s' dev r R sz aa ba y ya cap) (?R'1768 a b s s' dev r R sz aa ba y ya capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. ?P1769 a b s s' dev r R sz aa ba y and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. ?P'1771 a b s s' dev r R sz aa ba ya and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 9. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz aa ba x y. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); cap_relation x y \<and> is_arch_cap x\<rbrakk> \<Longrightarrow> ((\<lambda>x. acap_relation x \<circ> capCap) \<circ> the_arch_cap) x y
 2. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1768 a b s s' dev r R sz aa ba y ya cap) (?R'1768 a b s s' dev r R sz aa ba y ya capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 3. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. cte_wp_at is_arch_cap (a, b) and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres (=) (?R1768 a b s s' dev r R sz aa ba y ya cap) (?R'1768 a b s s' dev r R sz aa ba y ya capa) (do y <- set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b);
return []
od) (do y <- updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa));
return []
od)
 2. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>?R1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>?R'1768 a b s s' dev r R sz aa ba y ya\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. cte_wp_at is_arch_cap (a, b) and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 7. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (11 subgoals):
 1. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> corres dc (?P1797 a b s s' dev r R sz aa ba y ya cap) (?P'1799 a b s s' dev r R sz aa ba y ya capa) (set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b)) (updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)))
 2. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. ?P1797 a b s s' dev r R sz aa ba y ya cap and ?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. ?P'1799 a b s s' dev r R sz aa ba y ya capa and ?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. cte_wp_at is_arch_cap (a, b) and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 9. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa; is_page_cap cap\<rbrakk> \<Longrightarrow> corres dc (?P1805 a b s s' dev r R sz aa ba y ya cap) (?P'1799 a b s s' dev r R sz aa ba y ya capa) (set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b)) (updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)))
 2. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. ?P1805 a b s s' dev r R sz aa ba y ya cap and (\<lambda>s. is_page_cap cap) and ?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. ?P'1799 a b s s' dev r R sz aa ba y ya capa and ?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. cte_wp_at is_arch_cap (a, b) and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 9. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa; is_page_cap cap\<rbrakk> \<Longrightarrow> cap_relation (cap.ArchObjectCap (update_map_data cap None)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa))
 2. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data cap None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and (\<lambda>s. is_page_cap cap) and ?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. cte_wp_at is_arch_cap (a, b) and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 9. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace> set_cap (cap.ArchObjectCap (update_map_data cap None)) (a, b) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>a b s s' dev r R sz aa ba y ya cap capa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya; acap_relation cap capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace> updateCap (cte_map (a, b)) (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capa)) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1770 a b s s' dev r R sz aa ba y\<rbrace> liftM the_arch_cap (get_cap (a, b)) \<lbrace>\<lambda>cap. valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data cap None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) and (\<lambda>s. is_page_cap cap) and ?Q1798 a b s s' dev r R sz aa ba y ya cap\<rbrace>
 4. \<And>a b s s' dev r R sz aa ba y ya. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace> liftM capCap (getSlotCap (cte_map (a, b))) \<lbrace>\<lambda>capa. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'1800 a b s s' dev r R sz aa ba y ya capa\<rbrace>
 5. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q1762 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>y. cte_wp_at is_arch_cap (a, b) and ?Q1770 a b s s' dev r R sz aa ba y\<rbrace>
 6. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and ?Q'1772 a b s s' dev r R sz aa ba ya\<rbrace>
 7. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and ?Q1762 a b s s' dev r R sz aa ba) sa
 8. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?P'1847 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>rv s. \<forall>cap. cte_wp_at ((=) cap) (a, b) s \<longrightarrow> ((\<lambda>cap s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data cap None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (a, b) s \<and> is_page_cap cap \<and> True) \<circ> the_arch_cap) cap s\<rbrace>
 2. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and (\<lambda>sa. cte_wp_at is_arch_cap (a, b) sa \<and> ?P'1847 a b s s' dev r R sz aa ba sa)) sa
 4. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?P'1847 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>rv s. \<forall>cap. caps_of_state s (a, b) = Some cap \<longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> cap_master_cap cap = cap_master_cap (cap.ArchObjectCap (update_map_data (the_arch_cap cap) None)) \<and> \<not> is_reply_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_ep_cap cap \<and> \<not> is_ntfn_cap cap \<and> is_page_cap (the_arch_cap cap)\<rbrace>
 2. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and (\<lambda>sa. cte_wp_at is_arch_cap (a, b) sa \<and> ?P'1847 a b s s' dev r R sz aa ba sa)) sa
 4. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?P'1847 a b s s' dev r R sz aa ba\<rbrace> unmap_page sz aa ba r \<lbrace>\<lambda>ra sa. valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> (\<forall>c. caps_of_state sa (a, b) = Some c \<longrightarrow> cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data (the_arch_cap c) None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c \<and> is_page_cap (the_arch_cap c))\<rbrace>
 2. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)\<rbrace>
 3. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and (\<lambda>sa. cte_wp_at is_arch_cap (a, b) sa \<and> ?P'1847 a b s s' dev r R sz aa ba sa)) sa
 4. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. pspace_aligned' and pspace_distinct' and (\<lambda>s. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (cte_map (a, b)) s \<and> ((\<lambda>capa s. pspace_aligned' s \<and> pspace_distinct' s \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s \<and> True) \<circ> capCap) cap s)\<rbrace>
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and (\<lambda>s. cte_wp_at is_arch_cap (a, b) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (\<forall>c. caps_of_state s (a, b) = Some c \<longrightarrow> cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data (the_arch_cap c) None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c \<and> is_page_cap (the_arch_cap c)))) sa
 3. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (5 subgoals):
 1. \<And>a b s s' dev r R sz aa ba. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; \<exists>cte. ctes_of s' (cte_map (a, b)) = Some cte \<and> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) cte; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1762 a b s s' dev r R sz aa ba\<rbrace> unmapPage sz aa ba r \<lbrace>\<lambda>ya. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a) and (\<lambda>s. (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte))\<rbrace>
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and (\<lambda>s. cte_wp_at is_arch_cap (a, b) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (\<forall>c. caps_of_state s (a, b) = Some c \<longrightarrow> cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data (the_arch_cap c) None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c \<and> is_page_cap (the_arch_cap c)))) sa
 3. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and ?Q'1762 a b s s' dev r R sz aa ba) sa
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 5. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs and valid_etcbs and (\<lambda>s. cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s \<and> s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) sa\<rbrakk> \<Longrightarrow> (invs and valid_etcbs and K (valid_unmap sz (aa, ba) \<and> ba < kernel_base \<and> aa \<le> mask local.asid_bits) and (\<lambda>s. cte_wp_at is_arch_cap (a, b) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (\<forall>c. caps_of_state s (a, b) = Some c \<longrightarrow> cap_master_cap c = cap_master_cap (cap.ArchObjectCap (update_map_data (the_arch_cap c) None)) \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c \<and> is_page_cap (the_arch_cap c)))) sa
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte))) sa
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); 0 < aa; invs sa; is_aligned ba pageBits; valid_etcbs sa; sz = ARMSuperSection \<longrightarrow> is_aligned ba 24; caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); sa \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); sz = ARMLargePage \<longrightarrow> is_aligned ba 16; sz = ARMSection \<longrightarrow> is_aligned ba 20\<rbrakk> \<Longrightarrow> ba < kernel_base \<and> aa \<le> mask local.asid_bits \<and> is_arch_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))) \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> cap_master_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))) = cap_master_cap (cap.ArchObjectCap (update_map_data (arch_cap.PageCap dev r R sz (Some (aa, ba))) None)) \<and> \<not> is_reply_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))) \<and> \<not> is_master_reply_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte))) sa
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); 0 < aa; invs sa; is_aligned ba pageBits; valid_etcbs sa; sz = ARMSuperSection \<longrightarrow> is_aligned ba 24; caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); sa \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); sz = ARMLargePage \<longrightarrow> is_aligned ba 16; sz = ARMSection \<longrightarrow> is_aligned ba 20\<rbrakk> \<Longrightarrow> ba < kernel_base \<and> aa \<le> mask local.asid_bits \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> cap_master_cap (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))) = cap_master_cap (cap.ArchObjectCap (update_map_data (arch_cap.PageCap dev r R sz (Some (aa, ba))) None))
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte))) sa
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); 0 < aa; invs sa; is_aligned ba pageBits; valid_etcbs sa; sz = ARMSuperSection \<longrightarrow> is_aligned ba 24; caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); sa \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); sz = ARMLargePage \<longrightarrow> is_aligned ba 16; sz = ARMSection \<longrightarrow> is_aligned ba 20\<rbrakk> \<Longrightarrow> ba < kernel_base \<and> aa \<le> mask local.asid_bits \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte))) sa
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); caps_of_state s (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); 0 < aa; invs sa; is_aligned ba pageBits; valid_etcbs sa; sz = ARMSuperSection \<longrightarrow> is_aligned ba 24; caps_of_state sa (a, b) = Some (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); if dev then typ_at (AArch (ADeviceData sz)) r sa else typ_at (AArch (AUserData sz)) r sa; sz = ARMLargePage \<longrightarrow> is_aligned ba 16; sz = ARMSection \<longrightarrow> is_aligned ba 20; cap_aligned (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba)))); if dev then typ_at (AArch (ADeviceData sz)) r s else typ_at (AArch (AUserData sz)) r s; R \<in> valid_vm_rights; aa < 2 ^ local.asid_bits; vmsz_aligned ba sz; ba < kernel_base\<rbrakk> \<Longrightarrow> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa
 2. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte))) sa
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>a b s s' dev r R sz aa ba sa. \<lbrakk>pgi = ARM_A.PageUnmap (arch_cap.PageCap dev r R sz (Some (aa, ba))) (a, b); pgi' = ARM_H.PageUnmap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))) (cte_map (a, b)); (s, s') \<in> state_relation; invs s; invs' s'; valid_etcbs s; cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s'; valid_unmap sz (aa, ba); valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s'; vs_valid_duplicates' (ksPSpace s'); cte_wp_at ((=) (cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))))) (a, b) s; s \<turnstile> cap.ArchObjectCap (arch_cap.PageCap dev r R sz (Some (aa, ba))); (invs' and (\<lambda>s. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba))))) (cte_map (a, b)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap dev r (vmrights_map R) sz (Some (aa, ba)))) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) sa\<rbrakk> \<Longrightarrow> (valid_objs' and valid_arch_state' and pspace_aligned' and pspace_distinct' and no_0_obj' and cur_tcb' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> (\<exists>cte. ctes_of s (cte_map (a, b)) = Some cte))) sa
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (2 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')
 2. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (2 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) (do y <- when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od);
return []
od)
 2. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres (=) (?Q2150 x31 x32 x33 x34 x35 x36) (?Q'2150 x31 x32 x33 x34 x35 x36) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) (do y <- when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od);
return []
od)
 2. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ?Q2150 x31 x32 x33 x34 x35 x36 s
 3. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?Q'2150 x31 x32 x33 x34 x35 x36 s
 4. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres dc (?P2154 x31 x32 x33 x34 x35 x36) (?P'2154 x31 x32 x33 x34 x35 x36) (when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od)) (when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od))
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> (?P2154 x31 x32 x33 x34 x35 x36 and ?Q2154 x31 x32 x33 x34 x35 x36) s
 5. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (?P'2154 x31 x32 x33 x34 x35 x36 and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (6 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> corres dc (?P2163 x31 x32 x33 x34 x35 x36) (?P'2163 x31 x32 x33 x34 x35 x36) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> ?P2163 x31 x32 x33 x34 x35 x36 x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 5. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> ?P'2163 x31 x32 x33 x34 x35 x36 x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 6. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> corres dc (?R2166 x31 x32 x33 x34 x35 x36 root_switched) (?R'2166 x31 x32 x33 x34 x35 x36 root_switcheda) (do y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) (do y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switcheda (getCurThread >>= setVMRoot)
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?R2166 x31 x32 x33 x34 x35 x36\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>?R'2166 x31 x32 x33 x34 x35 x36\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (11 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> corres_underlying Id False True (?r'2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda) (\<lambda>_. True) (\<lambda>_. True) (do_flush x31 x32 x33 x34) (doFlush (flush_type_map x31) x32 x33 x34)
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; ?r'2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya\<rbrakk> \<Longrightarrow> corres dc (?R2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y) (?R'2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya) (when root_switched (gets cur_thread >>= set_vm_root)) (when root_switcheda (getCurThread >>= setVMRoot))
 3. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?R2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>?R'2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 9. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 10. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y) (?R'2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya) (when root_switched (gets cur_thread >>= set_vm_root)) (when root_switcheda (getCurThread >>= setVMRoot))
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?R2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>?R'2171 x31 x32 x33 x34 x35 x36 root_switched root_switcheda\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 9. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (10 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?P2182 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y) (?P'2184 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>y x. root_switched \<longrightarrow> ?P2182 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y x\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> ?P'2184 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya x\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 9. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 10. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (12 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya rv rv'. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya; rv = rv'\<rbrakk> \<Longrightarrow> corres dc (?R2187 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya rv) (?R'2187 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya rv') (set_vm_root rv) (setVMRoot rv')
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q2188 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y\<rbrace> gets cur_thread \<lbrace>?R2187 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2189 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya\<rbrace> getCurThread \<lbrace>?R'2187 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>y x. root_switched \<longrightarrow> ((\<lambda>_. True) and ?Q2188 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y) x\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> ((\<lambda>_. True) and ?Q'2189 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya) x\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 10. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda rv rv'. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; rv = rv'\<rbrakk> \<Longrightarrow> corres dc (?R2187 x31 x32 x33 x34 x35 x36 root_switcheda root_switcheda () () rv') (?R'2187 x31 x32 x33 x34 x35 x36 root_switcheda root_switcheda () () rv') (set_vm_root rv') (setVMRoot rv')
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q2188 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y\<rbrace> gets cur_thread \<lbrace>?R2187 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2189 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya\<rbrace> getCurThread \<lbrace>?R'2187 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>y x. root_switched \<longrightarrow> ((\<lambda>_. True) and ?Q2188 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y) x\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> ((\<lambda>_. True) and ?Q'2189 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya) x\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 10. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q2188 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y\<rbrace> gets cur_thread \<lbrace>\<lambda>a. tcb_at a and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda y ya. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2189 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya\<rbrace> getCurThread \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' a and no_0_obj'\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>y x. root_switched \<longrightarrow> ((\<lambda>_. True) and ?Q2188 x31 x32 x33 x34 x35 x36 root_switched root_switcheda y) x\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> ((\<lambda>_. True) and ?Q'2189 x31 x32 x33 x34 x35 x36 root_switched root_switcheda ya) x\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 9. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 10. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>y x. root_switched \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. (tcb_at (cur_thread a) and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs) a)) x\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) x\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 8. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (9 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q2173 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>y x. root_switcheda \<longrightarrow> cur_tcb x \<and> valid_arch_state x \<and> valid_objs x \<and> valid_asid_map x \<and> unique_table_refs (caps_of_state x) \<and> valid_vs_lookup x \<and> valid_global_objs x \<and> pspace_aligned x \<and> pspace_distinct x \<and> valid_vspace_objs x\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) x\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and ?Q2173 x31 x32 x33 x34 x35 x36 root_switched\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 8. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 9. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) x\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and (\<lambda>s. cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 root_switched root_switcheda. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; root_switched = root_switcheda\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace> doMachineOp (doFlush (flush_type_map x31) x32 x33 x34) \<lbrace>\<lambda>ya x. root_switcheda \<longrightarrow> pspace_aligned' x \<and> pspace_distinct' x \<and> valid_arch_state' x \<and> cur_tcb' x \<and> no_0_obj' x\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2166 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>root_switched. (\<lambda>_. True) and (\<lambda>s. cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2166 x31 x32 x33 x34 x35 x36\<rbrace> setVMRootForFlush x35 x36 \<lbrace>\<lambda>root_switcheda. (\<lambda>_. True) and ?Q'2174 x31 x32 x33 x34 x35 x36 root_switcheda\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> \<lbrace>?Q'2154 x31 x32 x33 x34 x35 x36\<rbrace> when (x32 < x33) (do root_switched <- setVMRootForFlush x35 x36;
y <- doMachineOp (doFlush (flush_type_map x31) x32 x33 x34);
when root_switched (getCurThread >>= setVMRoot)
od) \<lbrace>\<lambda>y _. True\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and ?Q2166 x31 x32 x33 x34 x35 x36) x) and ?Q2154 x31 x32 x33 x34 x35 x36) s
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'2166 x31 x32 x33 x34 x35 x36) x) and ?Q'2154 x31 x32 x33 x34 x35 x36) s
 8. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs and valid_etcbs and valid_page_inv (ARM_A.PageFlush x31 x32 x33 x34 x35 x36)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (cur_tcb and vspace_at_asid x36 x35 and K (x36 \<noteq> 0 \<and> x36 \<le> mask local.asid_bits) and valid_asid_map and valid_vs_lookup and valid_vspace_objs and valid_global_objs and unique_table_refs \<circ> caps_of_state and valid_arch_state and pspace_aligned and pspace_distinct and (\<lambda>s. True \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> (valid_asid_map and K (x36 \<le> mask local.asid_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)) x) and (\<lambda>_. True)) s
 2. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>pgi' = ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36; pgi = ARM_A.PageFlush x31 x32 x33 x34 x35 x36; (invs' and valid_page_inv' (ARM_H.PageFlush (flush_type_map x31) x32 x33 x34 x35 x36) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x32 < x33 \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>s. True \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> cur_tcb' s \<and> no_0_obj' s)) x) and (\<lambda>_. True)) s
 3. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal (1 subgoal):
 1. \<And>x4. \<lbrakk>page_invocation_map pgi pgi'; pgi = ARM_A.PageGetAddr x4\<rbrakk> \<Longrightarrow> corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi') proof (prove)
goal:
No subgoals! proof (state)
this:
corres (=) (invs and valid_etcbs and valid_page_inv pgi) (invs' and valid_page_inv' pgi' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (perform_page_invocation pgi) (performPageInvocation pgi')

goal:
No subgoals!