theory Finalise_DR

lemma dcorres_unmap_page:
  notes swp_apply[simp del]
  shows "dcorres dc \<top> (invs and valid_pdpt_objs and
                  valid_cap (cap.ArchObjectCap (arch_cap.PageCap dev pg fun vmpage_size (Some (a, v)))))
              (PageTableUnmap_D.unmap_page (transform_asid a,v) pg (pageBitsForSize vmpage_size))
              (ARM_A.unmap_page vmpage_size a v pg)" apply (rule dcorres_expand_pfx) apply (clarsimp simp:valid_cap_def) apply (case_tac vmpage_size)
  \<comment> \<open>ARMSmallPage\<close> apply (simp add:ARM_A.unmap_page_def bindE_assoc mapM_x_singleton
       PageTableUnmap_D.unmap_page_def cdl_page_mapping_entries_def) apply (rule corres_guard_imp) apply (rule_tac P = "\<lambda>x. x = transform s'" and P' = "(=) s'"
                       in corres_split_catch [where f = dc and E = dc and E' =dc]) apply (rule corres_guard_imp) apply (rule_tac corres_splitEE[OF dcorres_find_pd_for_asid,simplified]) apply (simp_all add: cdl_page_mapping_entries_def liftE_distrib
                                   pageBitsForSize_def bindE_assoc mapM_x_singleton) apply (rule corres_splitEE[OF dcorres_lookup_pt_slot]) apply (rule corres_splitEE) apply (rule dcorres_might_throw) apply wp apply (rule corres_dummy_returnOk_l) apply (rule corres_splitEE) apply (simp add:transform_pt_slot_ref_def) apply (rule dcorres_store_invalid_pte[where pg_id = pg]) apply (simp add:liftE_distrib[symmetric] returnOk_liftE) apply (rule dcorres_symb_exec_r) apply (rule dcorres_flush_page) apply (wp do_machine_op_wp | clarsimp)+ apply (simp add: imp_conjR) apply ((wp check_mapping_pptr_pt_relation | wp (once) hoare_drop_imps)+)[1] apply (simp | wp lookup_pt_slot_inv)+ apply (simp add: dc_def
               | wp lookup_pt_slot_inv find_pd_for_asid_kernel_mapping_help
               | rule conjI | clarify)+

   \<comment> \<open>ARMLargePage\<close> apply (simp add: ARM_A.unmap_page_def bindE_assoc mapM_x_singleton
                     PageTableUnmap_D.unmap_page_def cdl_page_mapping_entries_def) apply (rule corres_guard_imp) apply (rule_tac P = "\<lambda>x. x = transform s'" and P' = "(=) s'"
                      in corres_split_catch [where f = dc and E = dc and E' =dc]) apply (rule corres_guard_imp) apply (rule_tac corres_splitEE[OF dcorres_find_pd_for_asid,simplified]) apply (simp_all add: cdl_page_mapping_entries_def liftE_distrib
                                  pageBitsForSize_def bindE_assoc mapM_x_singleton) apply (rule corres_splitEE[OF dcorres_lookup_pt_slot]) apply (rule corres_splitEE) apply (rule dcorres_might_throw) apply wp apply (rule dcorres_symb_exec_rE) apply (rule corres_dummy_returnOk_l) apply (rule corres_splitEE) apply simp apply (rule_tac F = "is_aligned xa 6" in corres_gen_asm2) apply (erule dcorres_unmap_large_page[where pg_id = pg]) apply (simp add:liftE_distrib[symmetric] returnOk_liftE) apply (rule dcorres_symb_exec_r) apply (rule dcorres_flush_page[unfolded dc_def]) apply (wp do_machine_op_wp | clarsimp)+ apply (simp add: imp_conjR is_aligned_mask) apply (rule hoare_vcg_conj_lift) apply (wp hoare_drop_imps)[1] apply (rule hoare_vcg_conj_lift) apply (wp hoare_drop_imps)[1] apply (rule hoare_strengthen_post[OF check_mapping_pptr_pt_relation]) apply fastforce apply (simp | wp lookup_pt_slot_inv)+ apply (simp add: dc_def
              | wp lookup_pt_slot_inv hoare_drop_imps find_pd_for_asid_kernel_mapping_help
              | safe)+

  \<comment> \<open>Section\<close> apply (simp add:ARM_A.unmap_page_def bindE_assoc mapM_x_singleton
     PageTableUnmap_D.unmap_page_def cdl_page_mapping_entries_def) apply (rule corres_guard_imp) apply (rule_tac P = "\<lambda>x. x = transform s'" and P' = "(=) s'"
                     in corres_split_catch [where f = dc and E = dc and E' =dc]) apply (rule corres_guard_imp) apply (rule_tac corres_splitEE[OF dcorres_find_pd_for_asid,simplified]) apply (simp_all add: cdl_page_mapping_entries_def liftE_distrib
                                 pageBitsForSize_def bindE_assoc mapM_x_singleton) apply (rule corres_splitEE) apply (rule dcorres_might_throw) apply wp apply (rule corres_dummy_returnOk_l) apply (rule corres_splitEE) apply simp apply (rule dcorres_delete_cap_simple_section[where oid = pg]) apply (simp add:liftE_distrib[symmetric] returnOk_liftE) apply (rule dcorres_symb_exec_r) apply (rule dcorres_flush_page[unfolded dc_def]) apply (wp do_machine_op_wp | clarsimp)+ apply (simp add: imp_conjR) apply ((wp check_mapping_pptr_section_relation | wp (once) hoare_drop_imps)+)[1] apply (simp | wp lookup_pt_slot_inv)+ apply (simp add: dc_def
            | wp lookup_pt_slot_inv find_pd_for_asid_kernel_mapping_help
            | safe)+

  \<comment> \<open>SuperSection\<close> apply (simp add: ARM_A.unmap_page_def bindE_assoc mapM_x_singleton
                   PageTableUnmap_D.unmap_page_def cdl_page_mapping_entries_def) apply (rule corres_guard_imp) apply (rule_tac P = "\<lambda>x. x = transform s'" and P' = "(=) s'"
                    in corres_split_catch [where f = dc and E = dc and E' =dc]) apply (rule corres_guard_imp) apply (rule_tac corres_splitEE[OF dcorres_find_pd_for_asid,simplified]) apply (simp_all add: cdl_page_mapping_entries_def liftE_distrib
                                pageBitsForSize_def bindE_assoc mapM_x_singleton) apply (rule corres_splitEE) apply (rule dcorres_might_throw) apply wp apply (rule dcorres_symb_exec_rE) apply (rule corres_dummy_returnOk_l) apply (rule corres_splitEE) apply simp apply (rule_tac F = "is_aligned pd 14" in corres_gen_asm2) apply (erule(2) dcorres_unmap_large_section[where pg_id = pg]) apply (simp add:liftE_distrib[symmetric] returnOk_liftE) apply (rule dcorres_symb_exec_r) apply (rule dcorres_flush_page[unfolded dc_def]) apply (wp do_machine_op_wp | clarsimp)+ apply (simp add: imp_conjR is_aligned_mask) apply (rule hoare_vcg_conj_lift) apply (wp hoare_drop_imps)[1] apply (rule hoare_vcg_conj_lift) apply (wp hoare_drop_imps)[1] apply (rule hoare_vcg_conj_lift) apply (rule hoare_strengthen_post[OF check_mapping_pptr_super_section_relation]) apply clarsimp apply (simp add:is_aligned_mask[symmetric] dc_def
              | wp lookup_pt_slot_inv hoare_drop_imps find_pd_for_asid_kernel_mapping_help
              | safe)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v))))) (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>s = transform s'; True; (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v))))) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg) proof (prove)
goal (4 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg) proof (prove)
goal (4 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg) proof (prove)
goal (6 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres dc (?Q17 s') (?Q'17 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; transform s' = s\<rbrakk> \<Longrightarrow> ?Q17 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> ?Q'17 s' s
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg) proof (prove)
goal (9 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>x. x = transform s') ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres dc (dc ft) (dc ft') (return ()) (return ())
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'21 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q21 s') s
 6. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'21 s') s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg) proof (prove)
goal (11 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q22 s') (?Q'22 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s = transform s'\<rbrakk> \<Longrightarrow> ?Q22 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> ?Q'22 s' s
 4. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres dc (dc ft) (dc ft') (return ()) (return ())
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'21 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q21 s') s
 8. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'21 s') s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun vmpage_size (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v vmpage_size; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg (pageBitsForSize vmpage_size)) (local.unmap_page vmpage_size a v pg)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R26 s' pd) (?R'26 s' pd) (doE x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s'\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R26 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'26 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s = transform s'\<rbrakk> \<Longrightarrow> ?Q22 s' s
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and ?Q'26 s') s
 6. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres dc (dc ft) (dc ft') (return ()) (return ())
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q21 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'21 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
y <- liftE (do y <- store_pte x InvalidPTE;
do_machine_op (cleanByVA_PoU x (addrFromPPtr x))
od);
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q21 s') s
 10. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'21 s') s
A total of 13 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R26 s' pd) (?R'26 s' pd) (doE x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R26 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'26 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 16) (local.unmap_page ARMLargePage a v pg)
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (11 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R31 s' pd x) (?R'31 s' pd xa) (doE y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE x <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa));
x <- liftE (store_pte xa InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>?R31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>?R'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 16) (local.unmap_page ARMLargePage a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'36 s' pd x xa) (?P37 s' pd x) (?P'39 s' pd xa) might_throw (throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)))
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; ?r'36 s' pd x xa rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R36 s' pd x xa rv) (?R'36 s' pd x xa xb) (liftE (delete_cap_simple x)) (doE x <- liftE (store_pte xa InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 3. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>?R36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>?R'36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. ?P37 s' pd x and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. ?P'39 s' pd xa and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' pd x xa s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_mapping_pptr pg ARMSmallPage (Inl xa) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R36 s' pd x xa rv) (?R'36 s' pd x xa xb) (liftE (delete_cap_simple x)) (doE x <- liftE (store_pte xa InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 3. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>?R36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>?R'36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R36 s' pd x xa rv) (?R'36 s' pd x xa xb) (liftE (delete_cap_simple x)) (doE x <- liftE (store_pte xa InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>?R36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>?R'36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R36 s' pd x xa rv) (?R'36 s' pd x xa xb) (liftE (delete_cap_simple x) >>=E returnOk) (doE x <- liftE (store_pte xa InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>?R36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>?R'36 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'53 s' pd x xa rv xb) (?P54 s' pd x xa rv) (?P'56 s' pd x xa xb) (liftE (delete_cap_simple x)) (liftE (store_pte xa InvalidPTE))
 2. \<And>s' pd x xa rv xb rva xc. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb; ?r'53 s' pd x xa rv xb rva xc\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R53 s' pd x xa rv xb rva) (?R'53 s' pd x xa rv xb xc) (returnOk rva) (doE y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 3. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q55 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'57 s' pd x xa xb\<rbrace> liftE (store_pte xa InvalidPTE) \<lbrace>?R'53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P54 s' pd x xa rv and ?Q55 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>\<lambda>xb. ?P'56 s' pd x xa xb and ?Q'57 s' pd x xa xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = (xa && ~~ mask pt_bits, unat (xa && mask pt_bits >> 2))\<rbrakk> \<Longrightarrow> dcorres (?r'53 s' pd (xa && ~~ mask pt_bits, unat (xa && mask pt_bits >> 2)) xa () ()) (?P54 s' pd (xa && ~~ mask pt_bits, unat (xa && mask pt_bits >> 2)) xa ()) (?P'56 s' pd (xa && ~~ mask pt_bits, unat (xa && mask pt_bits >> 2)) xa ()) (delete_cap_simple (xa && ~~ mask pt_bits, unat (xa && mask pt_bits >> 2))) (store_pte xa InvalidPTE)
 2. \<And>s' pd x xa rv xb rva xc. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb; ?r'53 s' pd x xa rv xb rva xc\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R53 s' pd x xa rv xb rva) (?R'53 s' pd x xa rv xb xc) (returnOk rva) (doE y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 3. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q55 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'57 s' pd x xa xb\<rbrace> liftE (store_pte xa InvalidPTE) \<lbrace>?R'53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P54 s' pd x xa rv and ?Q55 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>\<lambda>xb. ?P'56 s' pd x xa xb and ?Q'57 s' pd x xa xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' pd x xa rv xb rva xc. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb; dc rva xc\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R53 s' pd x xa rv xb rva) (?R'53 s' pd x xa rv xb xc) (returnOk rva) (doE y <- liftE (do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)));
liftE (flush_page ARMSmallPage pd a v)
odE)
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q55 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'57 s' pd x xa xb\<rbrace> liftE (store_pte xa InvalidPTE) \<lbrace>?R'53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q55 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>\<lambda>xb. pt_page_relation (xa && ~~ mask pt_bits) pg xa UNIV and invs and ?Q'57 s' pd x xa xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres dc (?R53 s' pd (transform_pt_slot_ref xa) xa () () ()) (?R'53 s' pd (transform_pt_slot_ref xa) xa () () ()) (return ()) (do _ <- do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa));
flush_page ARMSmallPage pd a v
od)
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q55 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'57 s' pd x xa xb\<rbrace> liftE (store_pte xa InvalidPTE) \<lbrace>?R'53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q55 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>\<lambda>xb. pt_page_relation (xa && ~~ mask pt_bits) pg xa UNIV and invs and ?Q'57 s' pd x xa xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' pd x xa rv. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres dc (?R53 s' pd (transform_pt_slot_ref xa) xa () () ()) (?Q'63 s' pd x xa rv) (return ()) (flush_page ARMSmallPage pd a v)
 2. \<And>s' pd x xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?R'53 s' pd (transform_pt_slot_ref xa) xa () () ()\<rbrace> do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)) \<lbrace>?Q'63 s' pd x xa\<rbrace>
 3. \<And>s' pd x xa cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q55 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'57 s' pd x xa xb\<rbrace> liftE (store_pte xa InvalidPTE) \<lbrace>?R'53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q55 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>\<lambda>xb. pt_page_relation (xa && ~~ mask pt_bits) pg xa UNIV and invs and ?Q'57 s' pd x xa xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?R'53 s' pd (transform_pt_slot_ref xa) xa () () ()\<rbrace> do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)) \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>s' pd x xa cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanByVA_PoU xa (addrFromPPtr xa)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q55 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'57 s' pd x xa xb\<rbrace> liftE (store_pte xa InvalidPTE) \<lbrace>?R'53 s' pd x xa rv xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q38 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q55 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl xa)) \<lbrace>\<lambda>xb. pt_page_relation (xa && ~~ mask pt_bits) pg xa UNIV and invs and ?Q'57 s' pd x xa xb\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q38 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSmallPage)) pg s' else typ_at (AArch (AUserData ARMSmallPage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; (aa, b) = transform_pt_slot_ref xa; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> check_mapping_pptr pg ARMSmallPage (Inl xa) \<lbrace>\<lambda>rv s. rv \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa UNIV s \<and> invs s\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 16) (local.unmap_page ARMLargePage a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSmallPage)) pg s' else typ_at (AArch (AUserData ARMSmallPage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; (aa, b) = transform_pt_slot_ref xa; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'40 s' pd xa\<rbrace> check_mapping_pptr pg ARMSmallPage (Inl xa) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa UNIV s) \<and> (rv \<longrightarrow> invs s)\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'40 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 16) (local.unmap_page ARMLargePage a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q31 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'31 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and (\<lambda>s. ARMSmallPage \<in> UNIV \<and> invs s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'26 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'31 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'26 s s
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 16) (local.unmap_page ARMLargePage a v pg)
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (7 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?P'175 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>rv s. UCAST(32 \<rightarrow> 12) (lookup_pd_slot rv v && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> invs s\<rbrace>, -
 2. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> True \<and> valid_vspace_objs s \<and> (pspace_aligned and valid_vspace_objs) s \<and> pspace_aligned s \<and> valid_idle s \<and> (pspace_aligned and valid_vspace_objs) s \<and> ?P'175 s s
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSmallPage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSmallPage; v < kernel_base; vmpage_size = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMSmallPage (Inl x));
xa <- liftE (store_pte x InvalidPTE);
y <- liftE (do_machine_op (cleanByVA_PoU x (addrFromPPtr x)));
liftE (flush_page ARMSmallPage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 16) (local.unmap_page ARMLargePage a v pg)
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 16) (local.unmap_page ARMLargePage a v pg)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) ((=) (transform s')) ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (5 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?Q249 s') (?Q'249 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; transform s' = s\<rbrakk> \<Longrightarrow> ?Q249 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> ?Q'249 s' s
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (8 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (\<lambda>x. x = transform s') ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q253 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'253 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q253 s') s
 6. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'253 s') s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (10 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?Q254 s') (?Q'254 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s = transform s'\<rbrakk> \<Longrightarrow> ?Q254 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> ?Q'254 s' s
 4. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q253 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'253 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q253 s') s
 8. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'253 s') s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (12 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R258 s' pd) (?R'258 s' pd) (doE x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q254 s'\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R258 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'258 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s = transform s'\<rbrakk> \<Longrightarrow> ?Q254 s' s
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and ?Q'258 s') s
 6. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q253 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'253 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
y <- liftE (do y <- assert (x && mask 6 = 0);
y <- mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q253 s') s
 10. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'253 s') s
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R258 s' pd) (?R'258 s' pd) (doE x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R258 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'258 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (10 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R263 s' pd x) (?R'263 s' pd xa) (doE y <- might_throw;
liftE (delete_cap_simple x)
odE) (doE x <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa));
x <- liftE (assert (xa && mask 6 = 0));
x <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>?R263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>?R'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (13 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'268 s' pd x xa) (?P269 s' pd x) (?P'271 s' pd xa) might_throw (throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)))
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; ?r'268 s' pd x xa rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R268 s' pd x xa rv) (?R'268 s' pd x xa xb) (liftE (delete_cap_simple x)) (doE x <- liftE (assert (xa && mask 6 = 0));
x <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 3. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>?R268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. ?P269 s' pd x and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. ?P'271 s' pd xa and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd x xa s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R268 s' pd x xa rv) (?R'268 s' pd x xa xb) (liftE (delete_cap_simple x)) (doE x <- liftE (assert (xa && mask 6 = 0));
x <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 3. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>?R268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R268 s' pd x xa rv) (?R'268 s' pd x xa xb) (liftE (delete_cap_simple x)) (doE x <- liftE (assert (xa && mask 6 = 0));
x <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>?R268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R268 s' pd x xa rv) (?Q'283 s' pd x xa rv xb rva) (liftE (delete_cap_simple x)) (doE x <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>?Q'283 s' pd x xa rv xb\<rbrace>
 3. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>?R268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R268 s' pd x xa rv) (?Q'283 s' pd x xa rv xb rva) (liftE (delete_cap_simple x) >>=E returnOk) (doE x <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>?Q'283 s' pd x xa rv xb\<rbrace>
 3. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>?R268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'289 s' pd x xa rv xb rva) (?P290 s' pd x xa rv) (?P'289 s' pd x xa rv xb rva) (liftE (delete_cap_simple x)) (liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))
 2. \<And>s' pd x xa rv xb rva rvb xc. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb; ?r'289 s' pd x xa rv xb rva rvb xc\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R289 s' pd x xa rv xb rva rvb) (?R'289 s' pd x xa rv xb rva xc) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 3. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'289 s' pd x xa rv xb rva\<rbrace> liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) \<lbrace>?R'289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>rva. ?P'289 s' pd x xa rv xb rva and ?Q'289 s' pd x xa rv xb rva\<rbrace>
 6. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P290 s' pd x xa rv and ?Q291 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres (?r'289 s' pd (transform_pt_slot_ref xa) xa () () ()) (?P290 s' pd (transform_pt_slot_ref xa) xa ()) (?P'289 s' pd (transform_pt_slot_ref xa) xa () () ()) (delete_cap_simple (transform_pt_slot_ref xa)) (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))
 2. \<And>s' pd x xa rv xb rva rvb xc. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb; ?r'289 s' pd x xa rv xb rva rvb xc\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R289 s' pd x xa rv xb rva rvb) (?R'289 s' pd x xa rv xb rva xc) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 3. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'289 s' pd x xa rv xb rva\<rbrace> liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) \<lbrace>?R'289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>rva. ?P'289 s' pd x xa rv xb rva and ?Q'289 s' pd x xa rv xb rva\<rbrace>
 6. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P290 s' pd x xa rv and ?Q291 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' pd x xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; is_aligned xa 6\<rbrakk> \<Longrightarrow> dcorres (?r'289 s' pd (transform_pt_slot_ref xa) xa () () ()) (?P290 s' pd (transform_pt_slot_ref xa) xa ()) (?P'300 s' pd (transform_pt_slot_ref xa) xa () () ()) (delete_cap_simple (transform_pt_slot_ref xa)) (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))
 2. \<And>s' pd x xa rv xb rva rvb xc. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb; ?r'289 s' pd x xa rv xb rva rvb xc\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R289 s' pd x xa rv xb rva rvb) (?R'289 s' pd x xa rv xb rva xc) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 3. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'289 s' pd x xa rv xb rva\<rbrace> liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) \<lbrace>?R'289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>rva. ?P'300 s' pd x xa rv xb rva and (\<lambda>s. is_aligned xa 6) and ?Q'289 s' pd x xa rv xb rva\<rbrace>
 6. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P290 s' pd x xa rv and ?Q291 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' pd x xa rv xb rva rvb xc. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb; dc rvb xc\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R289 s' pd x xa rv xb rva rvb) (?R'289 s' pd x xa rv xb rva xc) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE)
 2. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'289 s' pd x xa rv xb rva\<rbrace> liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) \<lbrace>?R'289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} and (\<lambda>s. is_aligned xa 6) and ?Q'289 s' pd x xa rv xb rva\<rbrace>
 5. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q291 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' pd x xa xc. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?R289 s' pd (transform_pt_slot_ref xa) xa () () () ()) (?R'289 s' pd (transform_pt_slot_ref xa) xa () () () xc) (return ()) (do _ <- do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))));
flush_page ARMLargePage pd a v
od)
 2. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'289 s' pd x xa rv xb rva\<rbrace> liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) \<lbrace>?R'289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} and (\<lambda>s. is_aligned xa 6) and ?Q'289 s' pd x xa rv xb rva\<rbrace>
 5. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q291 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s' pd x xa xc rv. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?R289 s' pd (transform_pt_slot_ref xa) xa () () () ()) (?Q'303 s' pd x xa xc rv) (return ()) (flush_page ARMLargePage pd a v)
 2. \<And>s' pd x xa xc. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?R'289 s' pd (transform_pt_slot_ref xa) xa () () () xc\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))) \<lbrace>?Q'303 s' pd x xa xc\<rbrace>
 3. \<And>s' pd x xa xc cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>?R289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'289 s' pd x xa rv xb rva\<rbrace> liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) \<lbrace>?R'289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} and (\<lambda>s. is_aligned xa 6) and ?Q'289 s' pd x xa rv xb rva\<rbrace>
 7. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q291 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' pd x xa xc. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?R'289 s' pd (transform_pt_slot_ref xa) xa () () () xc\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>s' pd x xa xc cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q291 s' pd x xa rv\<rbrace> liftE (delete_cap_simple x) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd x xa rv xb rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'289 s' pd x xa rv xb rva\<rbrace> liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C])) \<lbrace>?R'289 s' pd x xa rv xb rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd x xa rv xb. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>?R'268 s' pd x xa xb\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} and (\<lambda>s. is_aligned xa 6) and ?Q'289 s' pd x xa rv xb rva\<rbrace>
 6. \<And>s' pd x xa rv xb cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa; dc rv xb\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (xa && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q270 s' pd x\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q291 s' pd x xa rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd x xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; x = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl xa)) \<lbrace>?R'268 s' pd x xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q270 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 17 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} s \<and> is_aligned xa 6\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (10 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'272 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> invs s) \<and> (rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)) \<and> (rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} s)\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q'272 s' pd xa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (11 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?P372 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> invs s\<rbrace>
 2. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?P'373 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)) \<and> (rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} s)\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and (\<lambda>s. ?P372 s' pd xa s \<and> ?P'373 s' pd xa s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?P'373 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)) \<and> (rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} s)\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and (\<lambda>s. invs s \<and> ?P'373 s' pd xa s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (11 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?P382 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)\<rbrace>
 2. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?P'383 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} s\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and (\<lambda>s. invs s \<and> ?P382 s' pd xa s \<and> ?P'383 s' pd xa s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' pd aa b xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa\<rbrakk> \<Longrightarrow> \<lbrace>?P'383 s' pd xa\<rbrace> check_mapping_pptr pg ARMLargePage (Inl xa) \<lbrace>\<lambda>rv s. rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} s\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and (\<lambda>s. invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> ?P'383 s' pd xa s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (10 subgoals):
 1. \<And>s' pd aa b xa rv s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; (aa, b) = transform_pt_slot_ref xa; rv \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa (?S394 s' pd xa) s\<rbrakk> \<Longrightarrow> rv \<longrightarrow> xa && mask 6 = 0 \<longrightarrow> pt_page_relation (xa && ~~ mask pt_bits) pg xa {ARMLargePage} s
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and (\<lambda>s. invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> ARMLargePage \<in> ?S394 s' pd xa)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (9 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q263 s' pd\<rbrace> cdl_lookup_pt_slot pd v \<lbrace>\<lambda>x. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'263 s' pd\<rbrace> lookup_pt_slot pd v \<lbrace>\<lambda>xa. (\<lambda>_. True) and (\<lambda>s. invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> ARMLargePage \<in> {ARMLargePage})\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?Q'258 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. valid_vspace_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd v && ~~ mask pd_bits)) s) and pspace_aligned and valid_idle and K (is_aligned pd pd_bits) and K (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd v && mask pd_bits >> 2) \<notin> kernel_mapping_slots) and ?Q'263 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'258 s s
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (6 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?P'440 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>rv s. UCAST(32 \<rightarrow> 12) (lookup_pd_slot rv v && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)\<rbrace>, -
 2. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> True \<and> valid_vspace_objs s \<and> (pspace_aligned and valid_vspace_objs) s \<and> pspace_aligned s \<and> valid_idle s \<and> (pspace_aligned and valid_vspace_objs) s \<and> ?P'440 s s
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
x <- cdl_lookup_pt_slot pd v;
y <- might_throw;
liftE (delete_cap_simple x)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMLargePage (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMLargePage)) pg s' else typ_at (AArch (AUserData ARMLargePage)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMLargePage; v < kernel_base; vmpage_size = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- lookup_pt_slot pd v;
xa <- throw_on_false undefined (check_mapping_pptr pg ARMLargePage (Inl x));
xa <- liftE (assert (x && mask 6 = 0));
xa <- liftE (mapM (swp store_pte InvalidPTE) (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])) (last_byte_pte (last (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>xa. xa + x) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMLargePage pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData vmpage_size)) pg s' else typ_at (AArch (AUserData vmpage_size)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 20) (local.unmap_page ARMSection a v pg)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (2 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) ((=) (transform s')) ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (4 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?Q487 s') (?Q'487 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; transform s' = s\<rbrakk> \<Longrightarrow> ?Q487 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> ?Q'487 s' s
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (7 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (\<lambda>x. x = transform s') ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE)
 2. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'491 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q491 s') s
 6. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'491 s') s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (9 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?Q492 s') (?Q'492 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE)
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s = transform s'\<rbrakk> \<Longrightarrow> ?Q492 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> ?Q'492 s' s
 4. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'491 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q491 s') s
 8. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'491 s') s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (11 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R496 s' pd) (?R'496 s' pd) (doE y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q492 s'\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R496 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'496 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s = transform s'\<rbrakk> \<Longrightarrow> ?Q492 s' s
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and ?Q'496 s') s
 6. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'491 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- store_pde (lookup_pd_slot pd v) InvalidPDE;
do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)))
od);
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q491 s') s
 10. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'491 s') s
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R496 s' pd) (?R'496 s' pd) (doE y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R496 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'496 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (10 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'501 s' pd) (?P501 s' pd) (?P'501 s' pd) might_throw (throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))))
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; ?r'501 s' pd rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R501 s' pd rv) (?R'501 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (doE x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>?R501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. ?P501 s' pd and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. ?P'501 s' pd and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (10 subgoals):
 1. \<And>s' pd s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R501 s' pd rv) (?R'501 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (doE x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>?R501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (9 subgoals):
 1. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R501 s' pd rv) (?R'501 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (doE x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>?R501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (9 subgoals):
 1. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R501 s' pd rv) (?R'501 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) >>=E returnOk) (doE x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>?R501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (12 subgoals):
 1. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'514 s' pd rv x) (?P515 s' pd rv) (?P'517 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (liftE (store_pde (lookup_pd_slot pd v) InvalidPDE))
 2. \<And>s' pd rv x rva xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x; ?r'514 s' pd rv x rva xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R514 s' pd rv x rva) (?R'514 s' pd rv x xa) (returnOk rva) (doE y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 3. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q516 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'518 s' pd x\<rbrace> liftE (store_pde (lookup_pd_slot pd v) InvalidPDE) \<lbrace>?R'514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P515 s' pd rv and ?Q516 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>\<lambda>x. ?P'517 s' pd x and ?Q'518 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (?r'514 s' pd () ()) (?P515 s' pd ()) (?P'517 s' pd ()) (delete_cap_simple (cdl_lookup_pd_slot pd v)) (store_pde (lookup_pd_slot pd v) InvalidPDE)
 2. \<And>s' pd rv x rva xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x; ?r'514 s' pd rv x rva xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R514 s' pd rv x rva) (?R'514 s' pd rv x xa) (returnOk rva) (doE y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 3. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q516 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'518 s' pd x\<rbrace> liftE (store_pde (lookup_pd_slot pd v) InvalidPDE) \<lbrace>?R'514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P515 s' pd rv and ?Q516 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>\<lambda>x. ?P'517 s' pd x and ?Q'518 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' pd rv x rva xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x; dc rva xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R514 s' pd rv x rva) (?R'514 s' pd rv x xa) (returnOk rva) (doE y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE)
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q516 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'518 s' pd x\<rbrace> liftE (store_pde (lookup_pd_slot pd v) InvalidPDE) \<lbrace>?R'514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q516 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>\<lambda>x. invs and pd_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and K (is_aligned pd pd_bits \<and> v < kernel_base) and ?Q'518 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?R514 s' pd () () ()) (?R'514 s' pd () () ()) (return ()) (do _ <- do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v)));
flush_page ARMSection pd a v
od)
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q516 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'518 s' pd x\<rbrace> liftE (store_pde (lookup_pd_slot pd v) InvalidPDE) \<lbrace>?R'514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q516 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>\<lambda>x. invs and pd_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and K (is_aligned pd pd_bits \<and> v < kernel_base) and ?Q'518 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd rv. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?R514 s' pd () () ()) (?Q'524 s' pd rv) (return ()) (flush_page ARMSection pd a v)
 2. \<And>s' pd. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?R'514 s' pd () () ()\<rbrace> do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))) \<lbrace>?Q'524 s' pd\<rbrace>
 3. \<And>s' pd cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q516 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'518 s' pd x\<rbrace> liftE (store_pde (lookup_pd_slot pd v) InvalidPDE) \<lbrace>?R'514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q516 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>\<lambda>x. invs and pd_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and K (is_aligned pd pd_bits \<and> v < kernel_base) and ?Q'518 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?R'514 s' pd () () ()\<rbrace> do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))) \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>s' pd cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q516 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'518 s' pd x\<rbrace> liftE (store_pde (lookup_pd_slot pd v) InvalidPDE) \<lbrace>?R'514 s' pd rv x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q501 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q516 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v))) \<lbrace>\<lambda>x. invs and pd_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and K (is_aligned pd pd_bits \<and> v < kernel_base) and ?Q'518 s' pd x\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
A total of 12 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> invs s \<and> pd_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s \<and> is_aligned pd pd_bits\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (7 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'501 s' pd\<rbrace> check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> invs s) \<and> (rv \<longrightarrow> pd_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s) \<and> (rv \<longrightarrow> is_aligned pd pd_bits)\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'501 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (6 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'496 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. invs s \<and> True \<and> is_aligned pd pd_bits)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'496 s s
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (4 subgoals):
 1. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> pspace_aligned s \<and> valid_vspace_objs s
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSection)) pg s' else typ_at (AArch (AUserData ARMSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSection; v < kernel_base; vmpage_size = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSection (Inr (lookup_pd_slot pd v)));
x <- liftE (store_pde (lookup_pd_slot pd v) InvalidPDE);
y <- liftE (do_machine_op (cleanByVA_PoU (lookup_pd_slot pd v) (addrFromPPtr (lookup_pd_slot pd v))));
liftE (flush_page ARMSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) ((=) (transform s')) ((=) s') (PageTableUnmap_D.unmap_page (transform_asid a, v) pg 24) (local.unmap_page ARMSuperSection a v pg) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) ((=) (transform s')) ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE <catch> (\<lambda>y. return ())) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?Q625 s') (?Q'625 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE <catch> (\<lambda>y. return ())) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE <catch> (\<lambda>y. return ()))
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; transform s' = s\<rbrakk> \<Longrightarrow> ?Q625 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> ?Q'625 s' s proof (prove)
goal (6 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (\<lambda>x. x = transform s') ((=) s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q629 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'629 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q629 s') s
 6. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'629 s') s proof (prove)
goal (8 subgoals):
 1. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?Q630 s') (?Q'630 s') (doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s = transform s'\<rbrakk> \<Longrightarrow> ?Q630 s' s
 3. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> ?Q'630 s' s
 4. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q629 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'629 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q629 s') s
 8. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'629 s') s proof (prove)
goal (10 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R634 s' pd) (?R'634 s' pd) (doE y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q630 s'\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R634 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'634 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s = transform s'\<rbrakk> \<Longrightarrow> ?Q630 s' s
 5. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and ?Q'634 s') s
 6. \<And>s' ft ft'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc ft ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (dc ft) (dc ft') (return ()) (return ())
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q629 s'\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'629 s'\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
y <- liftE (do y <- assert (lookup_pd_slot pd v && mask 6 = 0);
y <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]);
do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))))
od);
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>x. x = transform s') and ?Q629 s') s
 10. \<And>s' s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> ((=) s' and ?Q'629 s') s proof (prove)
goal (6 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R634 s' pd) (?R'634 s' pd) (doE y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE) (doE x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>?R634 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>?R'634 s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'639 s' pd) (?P639 s' pd) (?P'639 s' pd) might_throw (throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))))
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; ?r'639 s' pd rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R639 s' pd rv) (?R'639 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (doE x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>?R639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. ?P639 s' pd and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. ?P'639 s' pd and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>s' pd s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R639 s' pd rv) (?R'639 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (doE x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>?R639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R639 s' pd rv) (?R'639 s' pd x) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (doE x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>?R639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R639 s' pd rv) (?Q'650 s' pd rv x rva) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (doE x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>?Q'650 s' pd rv x\<rbrace>
 3. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>?R639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R639 s' pd rv) (?Q'650 s' pd rv x rva) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) >>=E returnOk) (doE x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>?Q'650 s' pd rv x\<rbrace>
 3. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>?R639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (13 subgoals):
 1. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'656 s' pd rv x rva) (?P657 s' pd rv) (?P'656 s' pd rv x rva) (liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))) (liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))
 2. \<And>s' pd rv x rva rvb xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x; ?r'656 s' pd rv x rva rvb xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R656 s' pd rv x rva rvb) (?R'656 s' pd rv x rva xa) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 3. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q658 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'656 s' pd rv x rva\<rbrace> liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) \<lbrace>?R'656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>rva. ?P'656 s' pd rv x rva and ?Q'656 s' pd rv x rva\<rbrace>
 6. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P657 s' pd rv and ?Q658 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (?r'656 s' pd () () ()) (?P657 s' pd ()) (?P'656 s' pd () () ()) (delete_cap_simple (cdl_lookup_pd_slot pd v)) (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))
 2. \<And>s' pd rv x rva rvb xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x; ?r'656 s' pd rv x rva rvb xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R656 s' pd rv x rva rvb) (?R'656 s' pd rv x rva xa) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 3. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q658 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'656 s' pd rv x rva\<rbrace> liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) \<lbrace>?R'656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>rva. ?P'656 s' pd rv x rva and ?Q'656 s' pd rv x rva\<rbrace>
 6. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P657 s' pd rv and ?Q658 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; is_aligned pd 14\<rbrakk> \<Longrightarrow> dcorres (?r'656 s' pd () () ()) (?P657 s' pd ()) (?P'665 s' pd () () ()) (delete_cap_simple (cdl_lookup_pd_slot pd v)) (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))
 2. \<And>s' pd rv x rva rvb xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x; ?r'656 s' pd rv x rva rvb xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R656 s' pd rv x rva rvb) (?R'656 s' pd rv x rva xa) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 3. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q658 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'656 s' pd rv x rva\<rbrace> liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) \<lbrace>?R'656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>rva. ?P'665 s' pd rv x rva and (\<lambda>s. is_aligned pd 14) and ?Q'656 s' pd rv x rva\<rbrace>
 6. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. ?P657 s' pd rv and ?Q658 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' pd rv x rva rvb xa. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x; dc rvb xa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. True)) (?R656 s' pd rv x rva rvb) (?R'656 s' pd rv x rva xa) (returnOk rvb) (doE y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE)
 2. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q658 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'656 s' pd rv x rva\<rbrace> liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) \<lbrace>?R'656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and (\<lambda>s. is_aligned pd 14) and ?Q'656 s' pd rv x rva\<rbrace>
 5. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q658 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' pd xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?R656 s' pd () () () ()) (?R'656 s' pd () () () xa) (return ()) (do _ <- do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))));
flush_page ARMSuperSection pd a v
od)
 2. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q658 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'656 s' pd rv x rva\<rbrace> liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) \<lbrace>?R'656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and (\<lambda>s. is_aligned pd 14) and ?Q'656 s' pd rv x rva\<rbrace>
 5. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q658 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' pd xa rv. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (\<lambda>rv rv'. True) (?R656 s' pd () () () ()) (?Q'669 s' pd xa rv) (return ()) (flush_page ARMSuperSection pd a v)
 2. \<And>s' pd xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?R'656 s' pd () () () xa\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))) \<lbrace>?Q'669 s' pd xa\<rbrace>
 3. \<And>s' pd xa cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q658 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>?R656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'656 s' pd rv x rva\<rbrace> liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) \<lbrace>?R'656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and (\<lambda>s. is_aligned pd 14) and ?Q'656 s' pd rv x rva\<rbrace>
 7. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q658 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' pd xa. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?R'656 s' pd () () () xa\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>s' pd xa cs. \<lbrakk>invs s'; Ball (ran (kheap s')) obj_valid_pdpt; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q658 s' pd rv\<rbrace> liftE (delete_cap_simple (cdl_lookup_pd_slot pd v)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' pd rv x rva. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?Q'656 s' pd rv x rva\<rbrace> liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) \<lbrace>?R'656 s' pd rv x rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' pd rv x. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>?R'639 s' pd x\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>rva. invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) and (\<lambda>s. is_aligned pd 14) and ?Q'656 s' pd rv x rva\<rbrace>
 6. \<And>s' pd rv x cs. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; dc rv x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> assert (lookup_pd_slot pd v && mask 6 = 0) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q639 s' pd\<rbrace> might_throw \<lbrace>\<lambda>rv. (\<lambda>a. True) and ?Q658 s' pd rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v))) \<lbrace>?R'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s \<and> is_aligned pd 14\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'639 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> invs s) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0)\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and ?Q'639 s' pd\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P730 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> invs s\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P'730 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0)\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. ?P730 s' pd s \<and> ?P'730 s' pd s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P'730 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0)\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. invs s \<and> ?P'730 s' pd s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P738 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x)\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P'738 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0)\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. invs s \<and> ?P738 s' pd s \<and> ?P'738 s' pd s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P'738 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s) \<and> (rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0)\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> ?P'738 s' pd s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P746 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s\<rbrace>
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P'746 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> ?P746 s' pd s \<and> ?P'746 s' pd s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s' pd rv s. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; rv \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s\<rbrakk> \<Longrightarrow> rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd_super_section_relation (lookup_pd_slot pd v && ~~ mask pd_bits) pg (lookup_pd_slot pd v) s
 2. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P'746 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> True \<and> ?P'746 s' pd s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 7. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>s' pd. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?P'746 s' pd\<rbrace> check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)) \<lbrace>\<lambda>rv s. rv \<longrightarrow> lookup_pd_slot pd v && mask 6 = 0 \<longrightarrow> pd && mask 14 = 0\<rbrace>
 2. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_find_pd_for_asid (transform_asid a, v) \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>?Q'634 s'\<rbrace> find_pd_for_asid a \<lbrace>\<lambda>pd. (\<lambda>_. True) and (\<lambda>s. invs s \<and> (\<forall>x\<in>ran (kheap s). obj_valid_pdpt x) \<and> True \<and> ?P'746 s' pd s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s' s. \<lbrakk>invs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection; s' = s\<rbrakk> \<Longrightarrow> valid_idle s \<and> ?Q'634 s s
 5. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE pd <- cdl_find_pd_for_asid (transform_asid a, v);
y <- might_throw;
liftE (delete_cap_simple (cdl_lookup_pd_slot pd v))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace>
 6. \<And>s'. \<lbrakk>invs s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; cap_aligned (ArchObjectCap (PageCap dev pg fun ARMSuperSection (Some (a, v)))); if dev then typ_at (AArch (ADeviceData ARMSuperSection)) pg s' else typ_at (AArch (AUserData ARMSuperSection)) pg s'; fun \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned v ARMSuperSection; v < kernel_base; vmpage_size = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> doE pd <- find_pd_for_asid a;
x <- throw_on_false undefined (check_mapping_pptr pg ARMSuperSection (Inr (lookup_pd_slot pd v)));
x <- liftE (assert (lookup_pd_slot pd v && mask 6 = 0));
x <- liftE (mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]));
y <- liftE (do_machine_op (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])) (last_byte_pde (last (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C]))) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pd v) [0 , 4 .e. 0x3C])))));
liftE (flush_page ARMSuperSection pd a v)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>dc\<rbrace> proof (prove)
goal:
No subgoals!